Hse Offshore Guide

HEALTH AND SAFETY EXECUTIVE HAZARDOUS INSTALLATIONS DIRECTORATE OFFSHORE DIVISION
GUIDANCE FOR THE TOPIC ASSESSMENT OF THE MAJOR ACCIDENT HAZARD ASPECTS OF SAFETY CASES
April 2006
CONTENTS 1. GENERAL 6 2. VESSEL IMPACT 12 2.HS1 Loss of Integrity of Structure, Process, Pipelines, Wells 16 2.HS2 Fatalities of Workforce 16 2.G1 Attendant and Passing Vessels 18 2.G2 Failures: Positional, Navigational, Procedural, Human Error 20 2.F1 Likelihood Factors [including historic data] 22 2.F2 Loss of Integrity to Installation Systems 23 2.F3 Fatalities to Workforce 23 2.F4 Subsea Facilities, Exclusion Zone 25 2.F5 Verification, Testing & Inspection 26 2.F6 SBVs, Communications & Procedures 27 2.F7 SBVs, Visual & Radar, Platform Mounted Radar, Automated Systems 28 2.F8 Procedures [Including Vessel Contracting, Vessel Suitability, Platform Operations, Inspections, Marine Operations and Combined Operations] 29 2.F9 Physical Protection 30 2.F10 Robust Structure, Plant and Equipment 31 3 LOSS OF STRUCTURAL INTEGRITY 32 3.HS1: Fixed Steel Installations 36 3.HS2: Fixed Concrete Installations 36 3.HS3: Semi Submersible Installations 36 3.HS4: Ship Shaped/Floating Installations 36 3.HS5: Jack-Up Installations 36 3.G1: Extreme Weather, including Wave-In-Deck Loading 39 3.G2: Fatigue Failure 39 3.G3: Corrosion 39 3.G4: Marine Growth 39 3.G11: Foundation Failure 39 3.G12: Scour 39 3.G13: Seismic Event 39 3.G5: Poor Fabrication Procedures/Materials Defects/ Materials Failure [Brittle Fracture]42 3.G6: Topsides Overloading 42 3.G7: Change of Use/Structural Modification 42 3.G17 Inadequate Management System Procedures 42 3.G18: Inadequate Design 42 3.G19: Inadequate Inspection, Repair & Maintenance During Fabrication and Operation 42 3.G20: Inadequate Re-assessment 42 3.G21: Inadequate Verification 42 3.G22: Operator Error 42 3.G8: Fire 47 3.G9: Explosion 47 3.G10: Blowout 47 3.G14: Boat Impact 47 3.G15: Helicopter/Aircraft Impact 47 3.G16: Dropped Objects 47 3.F1: Hazard Studies [HAZOPs etc] 49 3.F2: Generic Historical Data 49 3.F3: Installation Specific Data 49 3.F4: IVB Data 49 3.F5: Reliability Analysis 49 3.F6: Extent of Structural Damage/Failure 49 3.F7: Reduced Redundancy, Remaining Residual and Reserve Strength 49 3.F8: Remaining Fatigue Life 49 3.F9: Concept Selection 52 3.F10: Use of Best Design Practice 52
3.F11: Use of Suitable Safety Factors 3.F12: High Redundancy - Inherent Safety 3.F13: Optimum Materials and Fabrication Procedures 3.F14: Maintenance Management Procedures 3.F15: Sufficient Air Gap for 10,000-year Storm 3.F16: Suitable Safety Factors [Fatigue, Applied Loading, Pile loads etc] 3.F17: High Redundancy - Prevention 3.F18: Maintenance and Repair Management Procedures 3.F19: Control Measures [Management/Structural] for Accidental Loads 3.F20: Suitably Rated Fire and Blast Walls/Use of PFP etc 3.F21: Maintenance & Repair Management Procedures 3.F22: System Management Procedures for Accidental Loads 3.F23: High Redundancy Mitigation 4.1 LOSS OF MARITIME INTEGRITY - LOSS OF STABILITY 4.1.HS1 Jack Ups 4.1.HS2 Semi Subs 4.1.HS3 Monohulls 4.1.HS4 Other Types 4.1.G1-G5 Initiators 4.1.F1-F29 Risk Evaluation Measures 4.1.F30-49 Risk Management Measures 4.2 LOSS OF MARITME INTEGRITY - LOSS OF POSITION 4.2.HS1 Mooring System 4.2.G1-G5 Initiators 4.2.F1-F16 Risk Evaluation 4.2.F17-F35 Risk Management Measures 4.2.HS2 Dynamic Positioning 4.2.G1-G5 Initiators 4.2.F1-F16 Risk Evaluation 4.2.F17-F35 Risk Management Measures 5.1 LOSS OF CONTAINMENT - PROCESS 5.1.HS1: Pressure Vessels (Including Columns) 5.1.HS5: Piping and Piping Components 5.1.HS12: Valves 5.1.HS2: Heat Exchangers 5.1.HS3: Atmospheric Vessels [eg Wemcos, TPSs] 5.1.HS4: Centrifuges/Hydrocyclones 5.1.HS6: Smallbore Tubing 5.1.HS8: Flexible Hoses 5.1.HS9: Pumps 5.1.HS10: Compressors 5.1.HS11: Turbines 5.1.HS13: Deck Tanks 5.1.HS15: Hazardous Drains/Caisson 5.1.HS17: Flare Towers 5.1.HS18: Mechanical Integrity of FPSO Mooring Turrets 5.1.HS19: Temporary Equipment 5.1.G1 Part 1: Corrosion: Internal 5.1.G1 Part 2: Corrosion: External 5.1.G2: Erosion 5.1.G4 Internal explosion 5.1.G7: Fire 5.1.G24: Incorrect Material Specification 5.1.G26: Thermal Radiation 5.1.F1: Generic Historical Data 5.1.F2: Company and Installation Specific Data 5.1.F3: Installation Specific Hazard Studies
52 52 52 52 52 52 52 52 52 52 52 52 52 56 61 61 61 61 61 61 61 66 71 71 71 71 74 74 74 74 80 84 84 84 93 95 97 98 99 100 100 100 102 103 105 106 108 110 113 115 117 119 120 122 123 124 125
5.1.F4: Layout 5.1.F8: Safety Integrity Levels Standards 5.1.F10: Concept Selection 5.1.F11: Size of Release, Speed of Detection and Effectiveness 5.1.F12: Dispersion, Open or Closed Modules, Ventilation Rates 5.1.F14: Inherent Safety 5.1.F15: Relief Systems 5.1.F16: High Integrity Protection Systems [HIPS] 5.1.F17: Blowdown/Flare Systems 5.1.F18: Shutdown Systems 5.1.F19: Alarm and Trip Systems 5.1.F23: Isolations 5.2 LOSS OF CONTAINMENT PIPELINES 5.2.HS0: The Pipeline System 5.2.HS1: Rigid Risers 5.2.HS2: Other Risers including Flexible Risers 5.2.HS3: Outboard Pipeline 5.2.HS4: ESDV Valves (ESDV) 5.2.HS5: Subsea Isolation Systems (SSIS) 5.2.HS6: Pig Traps 5.3 LOSS OF CONTAINMENT FIRE & EXPLOSION 5.3.F1: Ignition Probability 5.3.F3: Delayed or Immediate Ignition 5.3.F7: Escalation, Layout, Separation, Open/Closed Modules 5.3.F8: Fire Types 5.3.F9: Thermal Flux, Smoke Obscuration Effects 5.3.F10: Fire Modelling 5.3.F11: Explosion Modelling 5.3.F13: Intrinsically Safe Electrical Equipment 5.3.F14: Separate Accommodation Jacket 5.3.F17: Normally Unmanned Installations (NUI) 5.3.F19: Layout No Jet Fire Targets 5.3.F20: Hazardous Area Zoning 5.3.F21: Electrical Equipment for Use in Potentially Flammable Atmospheres 5.3.F23 Fire/Smoke/Gas/Flame Detectors/Alarms 5.3.F24 Firewalls 5.3.F25 Passive Fire Protection [PFP] 5.3.F26 Resistant Temporary Refuges 5.3.F27 Deluge & Sprinklers 5.3.F28 Ventilation and HVAC 5.3.F29 Blast Walls 5.3.F30 Suppression and Flame Arrestors 6. WELLS 208 7. DIVING 215 7.HS1: Divers Life Support Equipment 7.HS2: Diving Bell/Basket Systems 7.HS3: Deck Chamber Complex 7.HS4: Common Systems 7.HS5: Diving Platform 7.F1-F3: Risk Evaluation 7.F1-F3: Risk Evaluation 7.F4-F9: Risk Management Measures 8. HELICOPTER CRASH 8.HS1 Helicopters 8.HS2: Other Aircraft 8.F1-F9: Risk Evaluation 8.F10-F20: Risk Management Measures
127 129 131 132 133 134 136 138 140 142 144 146 147 151 159 162 165 168 171 175 178 181 182 184 186 187 188 189 191 193 194 195 196 197 199 200 201 202 203 204 206 207
220 222 224 226 228 230 232 234 236 239 239 242 244
9. NON PROCESS FIRES & EXPLOSIONS 9.HS1: Accommodation Fires 9.HS2: Cellulosic Fires 9.HS3: Electrical Fires 9.HS4: Non Cellulosic Fires 10. Emergency Response 10.F1: Emergency Response Management 10.F2: Alarms and Communication 10.F3: Temporary Refuge and Muster Stations 10.F4: Access/Egress Routes 10.F5: Evacuation 10.F6: Escape 10.F7: Rescue and Recovery 10.F8: Ship Collision 10.F9: Emergency Lighting 10.F10: Emergency Communications 11. HUMAN FACTORS 11.G1: Human Error: Selection, Competence and Training 11.G2: Human Error: Stress, Fatigue, Shifts and Organisational Factors 11.G3: Human Error in Design 11.G4: ALARP & SFAIRP Awareness 11.G5: Command, Control, Communication [C3] and Decision Making 11.G6: Procedural Integrity 11.G7: Permit to Work Systems 11.G8: Employee Involvement 11.G9: Organisational Change Management 11.G10: Knowledge Management 11.G11: Contractualisation: Communications and Competence 11.G12: Multi Skilling/Multi Tasking 12. HUMAN VULNERABILITY 13. QUANTITATIVE RISK ASSESSMENT [QRA] 14. GLOSSARY OF ABBREVIATIONS
246 249 251 252 254 255 257 259 261 263 265 267 269 271 273 275 279 280 282 284 286 288 290 292 294 296 298 300 302 304 306 307
1.
1
GENERAL
Introduction The purpose of this document is to provide a framework of topic assessment principles and guidance in respect of the assessment of the major accident hazard aspects of offshore safety cases. The aims of this framework of assessment principles and guidance are:
to complement SCHAM in respect of topic assessment to form a component of the OSD quality system for safety case assessment to provide OSD with defensibility for the decisions made regarding the sufficiency of the technical content of offshore safety cases to give greater transparency to the assessment decisions and criteria to provide a basis for consistency in the assessment process and its outcomes to facilitate effective interfacing between the various topic assessments to provide guidance material for specialist assessors, including those who may be new to HSE, OSD or safety case assessment to identify where there are gaps in the supporting topic guidance to identify, by reference, relevant technical policy and good practice to assist assessors in the recording of judgements made during the assessment process [eg assessment briefs, issue notes, case completion reports, etc] by relating the judgements to particulars in the guidance to allow for peer review to be undertaken.
The document is intended primarily to assist topic assessors in undertaking assessment activities, but it does not purport to present definitive criteria in respect of the adequacy of the technical content of safety case submissions. Adequacy, or otherwise, is context specific and can only be finally determined by topic assessors using experience and judgement. The document will also be valuable to case managers and deputy case managers in understanding the basis and scope of the assessment considerations and the assessment outcomes. An aim of the guidance is to provide the offshore industry with reasonable clarification of HSEs expectations of the technical content of safety cases. The guidance should enable assessment to be undertaken in accordance with the requirements of the Offshore Installations (Safety Case) Regulations 2005 [SCR], through consideration of major accident hazards and the duty holders evaluation of risk and proposed risk control measures. Although the guidance indicates areas where measures for controlling risk are required, the document is not intended as an exhaustive statement of the available measures or of performance standards. Whilst the guidance contains reference to specific standards, models, methodologies, etc as representing good practice, alternative approaches proposed by a duty holder are likely
to be acceptable if the duty holder can demonstrate that the alternative approaches are equivalent, or better, in terms of health and safety, than those cited in the guidance. Information pertaining to the use of good practice and research information in safety case assessment is contained in SCHAM. The document can also be used to provide valuable reference material to identify good practice, together with industry, national and international standards, which will aid OSDs inspection and enforcement activities. 2 Scope The scope of this guidance is intended to address the assessment of duty holders submissions in respect of SCR Regulation 12 (1). The scope does not include the administrative procedures to be adopted for safety case assessment which are addressed in SCHAM. 3 Safety Management Systems Safety management systems (SMS) encompass many of the systems and procedures, the failure of which are key causal factors in most accidents/incidents. Moreover leadership based on sound values and policies can lead to a climate of improvements and gains in health, safety and sustainability. SMS are relevant to the lifecycle of an installation i.e. from initial concept design to dismantlement. A safety case should contain sufficient information to indicate that a clearly defined safety management system is in place for the installation, which complies with current good practice which includes the following examples: HS (G) 65 Successful Health and Safety Management Plant guidelines for the technical management of Chemical Process Safety AIChE STEP Guide to SMS Interfacing Assessment Principles for Offshore Safety Cases [APOSC] - Management of health and safety - Principle 2 A Guide to the Offshore Installations (Safety Case) Regulations 2005 (L30). Regulation 12 paragraphs 176 to 186 Offshore Installations (Prevention of Fire and Explosion, and Emergency Response) Regulations 1995 plus associated ACoP and guidance (L65) GASCET Chapter 11 - Human Factors The SMS should encompass the marine, helicopter and diving activities of the installation, and relevant aspects of combined operations. The areas of interface between the SMS of these operations, and the SMS of the installation, need to be identified and assessed for clarity, to ensure no potential hazard from either duplication/commission or omission. One key SMS issue is the area of examination, maintenance, test, and verification of equipment: particularly where the equipment in question is a safety critical element, as defined under the scheme of verification required by SCR, or the scheme for the systematic examination of plant required by PFEER, this includes the competence, experience and supervision of those who operate and maintain these safety critical elements. There is an overlap with the aspects of SMS that deal with verification and examination schemes, and there may be some synergy in an integrated assessment of these. Furthermore, as the above safety critical elements and plant will be identified in the
fire and explosion risk assessment for the installation, there is a link to the topic areas of risk assessment (GASCET Section 13) and fire/explosion (GASCET Section 5.3). 4 Assessment of Adequacy In assessing the major accident hazard aspects of safety case submissions it is necessary to determine the adequacy of, inter alia,
Hazard identification Risk evaluation Risk management measures [barriers and performance standards] The demonstration of compliance with the relevant statutory provisions
The significance and importance of the components of the above is dependent on the specific aspects of the installation being considered, e.g. the installation type and lifecycle stage. Each section addresses both installation type and lifecycle aspects. In general the base case guidance is for an operational safety case. Where points do not apply for certain types of safety case, or additional points do apply this is specifically identified. To assist in the assessment process prompt lists have been developed based on the experience of HSE personnel and these are documented in a categorisation table in each of the major accident sections. Each section that deals with a hazard has a categorisation table having six sub-sections that provide supporting information:
Source of Hazard Initiators Risk Evaluation Risk Management Measures Inherent Safety Prevention Detection Control Mitigation
Performance Standards
Additionally there are standalone sections for Emergency Response, Human Factors, Human Vulnerability and QRA.
4.1 Categorisation Table The prompt lists presented in the tables in each of the major accident hazard sections constitute a categorisation table for each major accident hazard. The categorisation table can be used in association with the installation specific aspects presented in the submission to identify sources of hazard and initiators that may combine to start escalation paths to a major accident, consequence paths that might thereafter ensue, and potential risk management measures. Where appropriate and available, areas where performance standards should be considered are identified.
4.2
Hazard Identification In general for a major accident to occur a source of hazard has to be present together with at least one initiator. In each major accident hazard section the appropriate categorisation table may include sub-classification of sources of hazard and does contain a number of initiators. Generally in each section the categorisation table contains grouping/subclassification of similar initiators. An assessor should examine the adequacy of the hazard identification in conjunction with the contents of the categorisation tables in each section.
4.3
Risk Evaluation The evaluation of the risk that might stem from each major accident hazard can be assessed by identification and evaluation of factors that might result in an adverse combination of source of hazard and initiator [causal chains], together with identification and evaluation of escalation paths that might result [consequence chains]. The information in each categorisation table under the heading of risk evaluation lists prompts to assist in assessing the adequacy of the duty holders identification and evaluation of such causal and consequence chains. These are subdivided into likelihood factors [factors affecting the frequency of the major accident] and consequences.
4.4
Risk Management Measures The adequacy of the duty holders identification and selection of risk management measures and their proposed implementation should be assessed. Such measures can be classified as barriers. These may be one or more of engineering, procedural or human [also classified as hardware, software or live ware]. By priority the barriers can be categorised as: Inherent Safety Prevention Detection Control Mitigation Each categorisation table contains potential risk management measures categorised according to these barrier types. An assessor should note that a duty holder might change the barrier emphasis to suit the company policy and/or the characteristics of a particular installation. An assessor should assess the adequacy of the barriers [and their associated performance standards] described in a safety case in combination for each major accident in the light of the nature of the hazards, the type of installation and the level of risk.
4.5
Performance Standards To assist in the assessment of the adequacy of the duty holders submission in relation to performance standards, areas where such standards might be required have been identified and listed in the categorisation tables in each section. Performance standards are generally installation and context specific and the adequacy of them must be judged on a case-by-case basis. In each section the relevant performance standards have been grouped into categories pertaining to the different risk management measures [barriers].
The associated text in each section provides details of, or reference to, good practice associated with each performance standard. In general the management of risks associated with major hazards for new installations should be better than for similar existing installations. Therefore for new installations and major modifications assessors should be looking for evidence that duty holders are adopting existing good practice [as a minimum], and for a clear indication how best practice is being addressed. 4.6 Depth of Assessment Each section provides an indication of the scope of assessment that is likely to be required according to the type of safety case and the nature of the circumstances. The depth of assessment is to be guided by the assessment and be sufficient to establish that the measures being taken will control the major accident risks so that the relevant statutory provisions are complied with.
In addition, in order to determine the adequacy of the demonstration of compliance with the relevant statutory provisions an assessor should consider whether a duty holder has adequately assessed the reasonable practicability of introducing further risk management measures, to further reduce risk.
Where safety case contents match with good practice identified in the assessment sheets for a particular topic associated with a major accident, there will usually be no need for an assessor to probe into the details of how the good practice is applied. This may, however, be a suitable issue to follow-up through inspection. 5 Interfaces between Assessors: Each section provides an indication of the topic teams that have an interest in the major accident in general and in particular the risk management measures and their performance standards through cross-referencing to other section as appropriate. This should be used as a guide to where dialogue between topic assessors will be required. 6 Reference Documents: There are a number of documents that provide generic guidance. These are listed below. L30 A Guide to the Offshore Installations (Safety Case) Regulations 2005 Third Edition HSE Books 2006 ISBN 0 7176 9184 9 Assessment Principles for Offshore Safety Cases [APOSC] HSE Offshore Information Sheet 2/2006 Offshore Installations (Safety Case) Regulations 2005 Regulation 12 Demonstrating compliance with the relevant statutory provisions SPC/Permissioning/09 HIDs Approach to ALARP Decisions The HSE ALARP Suite of Guidance, comprising: a) b) c) Principles and Guidelines to assist HSE in its Judgements that duty holders have reduced risks as low as reasonably practicable Assessing Compliance with the Law in Individual Cases and the Use of Good Practice Policy and Guidance on Reducing Risks as low as reasonably practicable in Design
10
d) e) f) g)
HSE principles for Cost benefit Analysis (CBA) in support of ALARP decisions Cost Benefit Analysis (CBA) Checklist ALARP at a glance Reducing Risks, Protecting People, HSEs Decision Making Process [R2P2]
L21 Management of Health and Safety at Work ACOP Second Edition HSE Books 2000 ISBN 0 7176 2488 9 UKOOA Risk Framework Document
11
2.
1.
VESSEL IMPACT
Scope This section provides guidance for the assessment of safety case content with respect to vessel collisions, from hazard identification through to consequence determination, including risk management measures. Interfaces with other sections are identified.
2.
Assessment of Adequacy of Demonstration

The evaluation of risk that might stem from each major accident hazard is to be assessed by identification of the factors that might result in an adverse combination of a hazard source and an initiator [causal chains], together with identification and evaluation of escalation paths that might result [consequence chains]. Two broad hazard sources can be identified and divided into a number of different vessel types thus:
Attendant vessels Passing vessels
For a major accident to be realised, these Hazard Sources need an Initiator. For vessel collisions, the following broad categories of Initiator are proposed:
Positioning Failure Navigational Failure Procedural Failure Human Error
Evaluation of risk will need consideration of the likelihood and consequence factors:
Frequency Consequence
The usual measures are employed in controlling the hazard:
Inherent Safety Prevention through Procedures Personnel High Visibility Incident Reporting and Analysis Detection
Control through Quality Assurance Operating envelope
12
Procedures Fenders/barriers
Mitigation Platform ESD system Pipeline subsea ESD valve Shock resistant plant Physical protection Structural integrity o o o o Robustness Redundancy Reserve strength Double hulls
3.
Emergency Response
Depth of Assessment This section gives guidance on the depth of assessment required to determine the adequacy of the demonstration that measures have been or will be taken to ensure compliance with the relevant statutory provisions. Where relevant sections of the safety case are consistent with the good practice identified in the assessment sheets, there will usually be no need for an assessor to probe into the details of the application of this practice. However, this may be a suitable issue to followup through inspection.
13
4. The assessor should examine the adequacy of the hazard identification, risk evaluation and management in conjunction with the contents of the Categorisation Table below:
Vessel Impact Source of Hazard
HS1 Loss of Integrity - Structure - Process - Pipelines - Wells HS2 Fatalities of Workforce G2 Failures - Positional - Navigational - Procedural - Human Error F1 Likelihood Factors [including historic data] Prevention F4 Subsea Facilities, Exclusion zone G1
Initiators
Attendant and Passing Vessels
Risk Evaluation
Frequency
Risk Management Measures

Inherent Safety
F5 F6
Verification, Testing and Inspection SBVs, Communications and Procedures
14
Vessel Impact Source of Hazard Initiators Risk Evaluation

F7

SBVs, Visual & Radar, Platform Mounted Radar, Automated Systems Procedures [Including Vessel Contracting and Suitability, Platform Operations, Inspections, Marine Operations and Combined Operations]
F8
Consequences F2 Loss of Integrity to Installation Systems [structural, process, pipelines, wells] Fatalities to Workforce F9 F10 Mitigation Physical Protection Robust Structure, Plant and Equipment
F3
15
2.HS1 2.HS2
1.
Loss of Integrity of Structure, Process, Pipelines, Wells Fatalities of Workforce
Confirmation should be obtained that the risks to the workforce, integrity of the structure, the topside process and safety related equipment, pipelines and wells from all foreseeable attendant and passing vessel collisions are or will be controlled to ensure compliance with the relevant provisions. This is achieved by a multidisciplinary approach using assessment sheets contained in the relevant sections. There are likely to be differing company standards used in demonstration and each should be examined for equivalence with general ALARP principles. Relevant Legislation, ACOP and Guidance includes: Offshore Installations (Safety Case) Regulations 2005 Offshore Installations and Wells (Design and Construction, etc) Regulations 1996 Assessment Principles for Offshore Safety Cases [APOSC]
2. 3.
4.
Specific Technical Issues: For passing vessels there should be time to take some form of emergency action and assessment should, in the main, be carried out in line with that in Section 10 Emergency Response. Attendant vessels may provide a more instantaneous vessel collision and hence it is expected that appropriate robustness is built into the installation engineering and safety systems.
5.
Other Related Assessment Sheets in this Section are: 2.F1 2.F2 2.F3 2.F4 2.F5 2.F6 2.F7 2.F8 Likelihood Factors [including historic data] Loss of Integrity to Installation Systems Fatalities to Workforce Subsea Facilities, Exclusion Zone Verification, Inspection, Testing SBVs, Communications, and Procedures SBVs visual and radar, platform mounted radar, automated systems Procedures - including Vessel contracting, vessel suitability, platform, operations, inspections, marine operations & combined operations
2. F9 Physical protection 2.F10 Robust Structure, plant and equipment 6. Cross-Referenced Sections and Sheets are: Sheet 3.G14 Sheet 4.1.G5 Sheet 10.F8 Section 11 Boat Impact Collision/Grounding Ship Collision Human Factors
16
Section 12 7.
Human Vulnerability
Lead Assessment Section for this Sheet: OSD5.5
8.
Team responsible for authoring and updating this sheet: OSD5.3
17
2.G1
1.
Attendant and Passing Vessels

Confirmation should be obtained that the all foreseeable attendant vessels have been identified and that particular passing vessels that may be in the vicinity of the installation have been identified. The adequacy of vessel identification process can only be assessed on an individual basis. Typical vessels may include:
2.
Attendant vessels Standby vessels Supply vessels Multi-purpose vessels MODUs Semis Jack-ups Drill ships Accommodation units Shuttle tankers Heavy lift vessels Anchor handling vessels Diving support vessels Survey vessels Well intervention vessels Tugs Barges Multi-role vessels [standby and supply] Pipe lay Counter pollution vessels
Passing vessels All of the above [when headed for other installations] Merchant vessels, including: Ferries Fishing craft Pleasure crafts Naval craft
18
Submarines Further consideration will be required where installations are located in known shipping routes. 3. Relevant Legislation, ACOP and Guidance includes: Offshore Installations (Safety Case) Regulations 2005 Offshore Installations and Wells (Design and Construction, etc) Regulations 1996 Assessment Principles for Offshore Safety Cases [APOSC] 4. Specific Technical Issues: None 5. Other Related Assessment Sheets in this Section are: None 6. Cross-Referenced Sections and Sheets are: None 7. Lead Assessment Section for this Sheet: OSD5.5 8. Team responsible for authoring and updating this sheet: OSD5.3
19
2.G2
1.
Failures: Positional, Navigational, Procedural, Human Error

For a major accident to be realised, the collision of passing and attendant vessels is caused by a failure on those vessels. For vessel collisions, the following broad categories of Initiator are proposed:
Positioning Failure DP failure Mooring failure Extreme weather Installation moves Weather vaning
Navigational Failure Watchkeeping failure Navigation equipment failure Navigation aids failure Mechanical failure Control system failure Power failure
Procedural Failure Incorrect/Inappropriate Not correctly applied
Human Error Commission/Omission/Fatigue
Specific assessment and guidance on these failures for passing vessels are outwith the scope of this document. However, some control can be expected on reducing the risk for initiators for attendant vessels. UKOOA Guidelines for Ship/Installation Collision Avoidance, 2003 2. 3. The above guidelines are generic in nature and treatment of the initiators for individual platforms and platform layouts should be assessed. Relevant Legislation, ACOP and Guidance includes: Offshore Installations (Safety Case) Regulations 2005 Offshore Installations and Wells (Design and Construction, etc) Regulations 1996 Assessment Principles for Offshore Safety Cases [APOSC] 4. Specific Technical Issues
20
Initiators for attendant vessels will be vessel, company and installation specific. Assessment should seek out this information. 5. Other Relevant Assessment Sheets in this Section are: 2.F5 2.F6 2.F7 2.F8 6. Verification, Testing & Inspection SBVs, Communications, and Procedures SBVs Visual and Radar, Platform Mounted Radar, Automated Systems Procedures - Including Vessel Contracting, Vessel Suitability, Platform Operations, Inspections, Marine Operations & Combined Operations
Cross Referenced Sections and Sheets are: Section 4.1 Section 4.2 Section 10 Section 11 Loss of Maritime Integrity - Loss of Stability Loss of Maritime Integrity - Loss of Position Emergency Response Human factors
7.
Lead Assessment for this Sheet: OSD5.5
8.
Team responsible for authoring this sheet: OSD5.3
21
2.F1
1.
Likelihood Factors [including historic data]

Confirmation should be obtained that the likelihood of vessel collisions has been derived from a recognised model or from a local marine traffic survey.

2.
Use of software, COAST, CRASH, COLLIDE, MAN Shipping surveys Historic data
Where the hazard identification process listed above has not been used, judgement as to the adequacy can only be assessed on an individual basis. Further consideration will be required on an installation specific basis.

3.
Installation location, particularly when sited near known shipping routes No dedicated standby vessel Vessel control and speed Point of contact with installation Vessel orientation
Relevant Legislation, ACOP and Guidance includes: Offshore Installations (Safety Case) Regulations 2005 Offshore Installations and Wells (Design and Construction, etc) Regulations 1996 Assessment Principles for Offshore Safety Cases [APOSC]
4.
Specific Technical Issues: None
5.
Other Related Assessment Sheets in this Section are: None
6.
Cross-Referenced Sections and Sheets are: None
7.
8.
22
2.F2 2.F3
1.
Loss of Integrity to Installation Systems Fatalities to Workforce

Confirmation should be obtained that all consequences of a vessel collision have been considered. The consequences may involve many disciplines and a multidisciplinary approach should have been used. Where a multidisciplinary approach has not been used, the adequacy should be judged by examining the completeness of the technical consequences documented. Relevant Legislation, ACOP and Guidance includes: Offshore Installations (Safety Case) Regulations 2005 Offshore Installations and Wells (Design and Construction, etc) Regulations 1996 Assessment Principles for Offshore Safety Cases [APOSC]
2. 3.
4.
Specific Technical Issues: Injuries to people o o Direct contact Strong vibration
Loss of structural integrity o o o Direct contact Strong vibration Large relative deformation
Loss of stability o o o Direct contact Strong vibration Large relative deformation
Loss of position o Direct contact
Loss of containment Loss of other safety critical equipment Loss of EER 5. Other Related Assessment Sheets in this Section are: 2.F9 2.F10 6. Physical Protection Robust Structure, Plant and Equipment
Cross-Referenced Sections and Sheets are:
23
Sheet 4.1.G5 Sheet 10.F8 Section 11 Section 12 7.
Collision/Grounding Ship Collision Human Factors Human Vulnerability
8.
24
2.F4
1.
Subsea Facilities, Exclusion Zone

Confirmation should be obtained that, where appropriate in design cases only, subsea facilities have been considered in the concept selection thus providing inherent safety by eliminating the need for surface facilities. Where surface facilities are provided confirmation should be obtained that the safety system acknowledges the management of appropriate exclusion zone. Not applicable. Relevant Legislation, ACOP and Guidance includes: Offshore Installations (Safety Case) Regulations 2005 Offshore Installations and Wells (Design and Construction, etc) Regulations 1996 Assessment Principles for Offshore Safety Cases [APOSC]
2. 3.
4.
Specific technical issues: None
5.
6.
Cross-Referenced Sections and Sheets are: Section 6 Section 11 Wells Human Factors
7.
8.
25
2.F5 Verification, Testing & Inspection

1. Confirmation should be obtained that procedures and equipment for the prevention of collisions follow the requirements of the recognised guidance/codes of practice below: UKOOA Guidelines for Ship/Installation Collision Avoidance 2003 UKOOA Guidelines for Survey of Vessels Standing by Offshore Installations 2001 UKOOA Guidelines for the Management & Operation of Vessels Standing by Offshore Installations 2001. UKOOA Guidelines for the Safe Management & Operation of Offshore Support Vessels 2002. Guidance & ACOP to the Offshore Installations (Prevention of Fire & Explosion & Emergency Response) Regulations 1995 (L65) Further guidance can be obtained from: OTO 1999 052 Effective Collision Risk Management for Offshore Installations 2. Where standard or guidance other than that listed above has been used, judgement as to the adequacy of the detection system can only be assessed on an individual basis. Alternative/additional measures may be required for other types of field arrangement or when standby vessel sharing is agreed. 3. Relevant Legislation, ACOP and Guidance includes: Offshore Installations (Safety Case) Regulations 2005 Offshore Installations and Wells (Design and Construction, etc) Regulations 1996 Assessment Principles for Offshore Safety Cases [APOSC] 4. Specific Technical Issues: None 5. Other Related Assessment Sheets in this Section are: 2.F7 2.F8 6. SBVs Visual & Radar, Platform Mounted Radar, Automated Systems Procedures [Including Vessel Contracting, Vessel Suitability, Platform Operations, Inspection, Marine Operations and Combined Operations]
Cross-Referenced Sections and Sheets are: Section 10 Section 11 Emergency Response Human Factors
7.
8.
26
2.F6
1.
SBVs, Communications & Procedures

Confirmation should be obtained that procedures and equipment for the prevention of collisions follow the requirements of the recognised guidance/codes of practice below: UKOOA Guidelines for Ship/Installation Collision Avoidance 2003 UKOOA Guidelines for Survey of Vessels Standing by Offshore Installations 2001 UKOOA Guidelines for the Management & Operation of Vessels Standing by Offshore Installations 2001 UKOOA Guidelines for the Safe Management & Operation of Offshore Support Vessels 2002 Offshore Installations (Prevention of Fire and Explosion, and Emergency Response) Regulations 1995 ACOP & Guidance L65 Further guidance can be obtained from: OTO 1999 052 Effective Collision Risk Management for Offshore Installations
2.
Where standard or guidance other than that listed above has been used, judgement as to the adequacy of the detection system can only be assessed on an individual basis. Alternative/additional measures may be required for other types of field arrangement or when standby vessel sharing is agreed.
3.
4.
5.
Other Related Assessment Sheets in this Section are: 2.F7 2.F8 SBVs Visual & Radar, Platform Mounted Radar, Automated Systems Procedures [Including Vessel Contracting, Vessel Suitability, Platform Operations, Inspection, Marine Operations and Combined Operations]
6.
7.
8.
27
2.F7
1.
SBVs, Visual & Radar, Platform Mounted Radar, Automated Systems

Confirmation should be obtained that detection equipment, operation and procedures follow the requirements of the recognised guidance/codes of practice below: UKOOA Guidelines for Ship/Installation Collision Avoidance 2003 UKOOA Guidelines for the Management & Operation of Vessels Standing by Offshore Installations 2001 L65 Guidance & ACOP to the Offshore Installations (Prevention of Fire and Explosion, and Emergency Response) Regulations 1995 Further guidance can be obtained from: OTO 1999 052 Effective Collision Risk Management for Offshore Installations OTO 97 058 Performance of Standby Vessel Radar
2.
Where standards or guidance other than that listed above has been used, judgement as to the adequacy of the detection system can only be assessed on an individual basis. Alternative/additional measures may be required for other types of field arrangement or when standby vessel sharing is agreed.
3.
4.
5.
Other Related Assessment Sheets in this Section are: 2.F5 2.F6 2.F8 Verification, Testing & Inspection SBVs, Communications & Procedures Procedures [Including Vessel Contracting, Vessel Suitability, Platform Operations, Inspection, Marine Operations and Combined Operations]
6.
7.
8.
28
2.F8
Procedures [Including Vessel Contracting, Vessel Suitability, Platform Operations, Inspections, Marine Operations and Combined Operations]
Confirmation should be obtained that the control of collision risks follow the requirements of the recognised guidance/codes of practice below: UKOOA Guidelines for Ship/Installation Collision Avoidance 2003 UKOOA Guidelines for the Safe Management & Operation of Offshore Support Vessels 2002 UKOOA Guidelines for Survey of Vessels Standing by Offshore Installations 2001 L65 Guidance & ACOP to the Offshore Installations (Prevention of Fire and Explosion, and Emergency Response) Regulations 1995 Further guidance can be obtained from: OTO 1999 052 Effective Collision Risk Management for Offshore Installations
1.
2.
Where standard or guidance other than that listed above has been used, judgement as to the adequacy of the detection system can only be assessed on an individual basis. Alternative/additional measures may be required for other types of field arrangement or when standby vessel sharing is agreed.
3.
4.
5.
Other Related Assessment Sheets in this Section are: 2.F5 2.F6 2.F7 Verification, Testing & Inspection SBVs, Communications & Procedures SBVs Visual & Radar, Platform Mounted Radar, Automated Systems
6.
7.
8.
29
2.F9
1.
Physical Protection
Confirmation should be obtained that all Safety Critical Elements [SCEs] within zones vulnerable to impact from attendant vessels are properly protected against damage due to direct impact, large relative deformations and strong vibrations. Examples of such SCEs are:
Risers [possibly including associated ESD valves] Conductors Caissons Escape routes and other EER related items
There is no specific guidance about what constitutes adequate protection, although some of the analysis techniques used in Section 3 Loss of Structural Integrity may be used to demonstrate strength through design. 2. Due to the lack of guidance at present, adequacy can only be assessed on an individual basis. Further consideration will be required where damage to SCEs is tolerated on the basis that other safeguards are in place. This may require discussion with other topic teams. 3. Relevant Legislation, ACOP and Guidance includes: Offshore Installations (Safety Case) Regulations 2005 Offshore Installations and Wells (Design and Construction, etc) Regulations 1996 Assessment Principles for Offshore Safety Cases [APOSC] 4. Specific Technical Issues: None 5. Other Related Assessment Sheets in this Section are: 2.F2 6. Loss of Integrity to Installation Systems
Cross-Referenced Sections and Sheets are: Section 3 Section 5.1 Section 5.2 Section 6 Section 10 Loss of Structural Integrity Loss of Containment - Process Loss of Containment - Pipelines Wells Emergency Response
7.
Lead Assessment Section for this Sheet: OSD5.1 to OSD5.3
8.
30
2.F10 Robust Structure, Plant and Equipment

1. Confirmation should be obtained that the safety critical plant and equipment in the installation can sustain the large displacements and strong vibrations resulting from reasonably foreseeable collisions from attendant vessels [see Section 3 Loss of Structural Integrity]. For structures there is limited authoritative guidance in this area: ON 27 Status of Technical Guidance on Design, Construction and Certification Also two main methods are currently available:

2. 3.
Qualitative through techniques such as Walkdown Quantitative by structural analysis coupled to survival criteria for the plant and equipment
Due to the lack of guidance at present, adequacy can only be assessed on an individual basis. Relevant Legislation, ACOP and Guidance includes: Offshore Installations (Safety Case) Regulations 2005 Offshore Installations and Wells (Design and Construction, etc) Regulations 1996 Assessment Principles for Offshore Safety Cases [APOSC]
4.
5.
Other Related Assessment Sheets in this Section are: 2.F2 Loss of Integrity of Installation Systems
6.
Cross-Referenced Sections and Sheets are: Section 3 Section 5.1 Section 5.2 Section 6 Loss of Structural Integrity Loss of Containment - Process Loss of Containment - Pipelines Wells
7.
Lead Assessment Section for this Sheet: OSD5.1 to OSD5.3 [structural aspects] OSD3 [plant and equipment]
8.
31
3
1.
LOSS OF STRUCTURAL INTEGRITY

Scope This Section provides guidance for the assessment of safety case content with respect to the loss of structural integrity of an installation, from hazard identification through to consequence determination, including risk management measures.
2.
Assessment of Adequacy of Demonstration The evaluation of risk that might stem from each major accident hazard is to be assessed by identification of the factors that might result in an adverse combination of a source of hazard and initiator, together with identification and evaluation of escalation paths that might result. The loss of structural integrity major accident hazard sources have been classified as follows:
Fixed steel installations Fixed concrete installations Semi submersible installations Ship shaped/floating installations Jack-up installations
For the latent major accident hazards to be activated towards a major accident, initiators have been identified. These have been classified as:

3.
Accidental hazards Environmental hazards Management system hazards
Depth of Assessment This section gives guidance on the depth of assessment required to determine the adequacy of the demonstration that measures have been or will be taken to ensure compliance with the relevant statutory provisions. Where safety case contents match with good practice identified in the assessment sheets for a particular topic associated with a major accident, there will usually be no need for an assessor to probe into the details of the how the good practice is applied. This may, however, be a suitable issue to follow-up through inspection. A list of references is provided in each assessment sheet. It should be noted that a more extensive commentary should be referenced. The documents listed provide further guidance, particularly in relation to good practice and performance standards. In some cases the reference material will not be fully applicable and may be limited in some parts. These aspects are referred to on the assessment sheets.
32
Loss of Structural Integrity Source of Hazard
HS1 Fixed Steel Installations Fixed Concrete Installations Semi submersible Installations ShipShaped/Floatin g Installations Jack-Up Installations G1
Initiators
Extreme Weather, incl. Wave-In-Deck Loading Fatigue Failure Corrosion F1
Risk Evaluation
Frequency

Inherent Safety
HS2 HS3
G2 G3
Hazard Studies [HAZOPS etc] Generic Historical Data
F9
Concept Selection
Substructure
Topsides
HS4
G4
Marine Growth
F2
F10
Use of Best Design Practice
HS5
G5
Poor Fabrication Procedures /Materials Defects/Materials Failure [Brittle Fracture] Topsides Overloading Change of Use/Structural Modification Fire
F3
Installation-Specific Data
F11
Use of Suitable Safety Factors
Fixed steel installations
G6 G7
F4 F5
IVB Data Reliability Analysis
F12 F13
High Redundancy Optimum Materials and Fabrication Procedures Maintenance Management Procedures
Fixed Concrete Installations Semi Submersibles
G8
F14
Ship-Shaped Installations/ Floaters [Hull] Jack-Ups
G9 G10
Explosion Blowout Prevention
33

G11 G12 G13
Initiators
Foundation Failure Scour Seismic Event F6
Risk Evaluation
Consequences F15 Extent of Structural Damage/Failure Reduced Redundancy, Remaining Residual & Reserve Strength Remaining Fatigue Life F16
Sufficient Air Gap for 10,000Year Storm Suitable Safety Factors (Fatigue, Applied Loading, Pile Loads etc) High Redundancy
G14
Boat Impact
F7
F17
G15 G16
Helicopter/Aircraft Impact Dropped Objects
F8
F18 F19
Maintenance and Repair Management Procedures Control Measures [Management/Structural] for Accidental Loads Extreme Weather Excess Topsides Weight Fire Explosion
G17
Inadequate Management System Procedures Inadequate Design Inadequate Inspection, Repair & Maintenance During Fabrication and Operation Inadequate Reassessment Inadequate Verification F20 F21 Suitably rated fire and blast walls/use of PFP etc. Maintenance & repair management procedures Mitigation
G18 G19
Fatigue Corrosion
G20 G21
Marine Growth Foundation Performance & Scour
Corrosion
34

G22
Initiators
Operator Error
Risk Evaluation
F22 F23

System management procedures for accidental loads High redundancy
Fire Explosion
35
3.HS1: 3.HS2: 3.HS3: 3.HS4: 3.HS5:

1.
Fixed Steel Installations Fixed Concrete Installations Semi Submersible Installations Ship Shaped/Floating Installations Jack-Up Installations
Confirmation should be obtained that installations have been designed and constructed, and/or re-assessed, maintained and repaired in accordance with the latest edition of a recognised standard, recommended practice or code of practice. Recognised standards, recommended practices and codes of practice include: ISO 19900 Petroleum and Natural Gas Industries Offshore Structures Part 1: General Requirements ISO 19901-1 Petroleum and Natural Gas Industries - Specific Requirements for Offshore Structures Part 1: Metocean Design and Operating Considerations ISO 19901-2 Petroleum and Natural Gas Industries - Specific Requirements For Offshore structures Part 2: Seismic Design Procedures and Criteria ISO 19901-3 Petroleum and Natural Gas Industries - Specific Requirements for Offshore Structures Part 3: Topsides Structure ISO 19901-4 Petroleum and Natural Gas Industries - Specific Requirements for Offshore Structures Part 4: Geotechnical and Foundations Design Considerations ISO 19901-5 Petroleum and Natural Gas Industries - Specific Requirements for Offshore Structures Part 5: Weight Control During Engineering and Construction ISO 19902 Petroleum and Natural Gas Industries - Fixed Steel Offshore Structures ISO 19903 Petroleum and Natural Gas Industries - Fixed Concrete Offshore Structures ISO 19904 Petroleum and Natural Gas Industries - Floating Offshore Structures ISO 19905, Petroleum and Natural Gas Industries - Site-Specific Assessment of Mobile Offshore Units ISO 13822 Basis of Design of Structures - Assessment of Existing Structures NORSOK N-001 Structural Design NORSOK N-002 Collection of Metocean Data NORSOK N-003 Actions and Load Effects NORSOK N-004 Design of Steel Structures: Annex A - Design Against Accidental Loads; Annex B - Buckling Strength of Shells; Annex C - Fatigue Strength Analysis NORSOK N-005 Condition Monitoring of Load Bearing Structures NORSOK S001 Technical Safety NORSOK Z-001 Documentation for Operation NORSOK Z-013 Risk and Emergency Preparedness Analysis
36
ON27 Status of Technical Guidance on design, Construction and Certification OTO 2001 010 Environmental Considerations OTO 2001 011 Corrosion Protection OTO 2001 012 Site Investigations OTO 2001 013 Loads OTO 2001 014 Foundations OTO 2001 015 Steel OTO 2001 016 Pile Sleeve Connections OTO 2001 017 Materials Other Than Steel Or Concrete OTO 2001 046 Concrete OTO 2001 048 Floating Installations OTO 2001 051 Self-Elevating Installations (Jack-Up Units) API RP2A 18th Edition or later Recommended Practice for Planning, Designing, and Constructing Fixed Offshore Platforms Classification Society Rules: Semi sub/Floating Installations/Jack-Ups only IMO Rules: Semi sub/Floating Installations/Jack-Ups only SNAME T&R Bulletin 5-5A 1994 Society of Naval Architects & Marine Engineers (SNAME) Recommended Practice for Site-specific Assessment of Mobile Jack-up Units 2. Where a standard, recommended industry/company practice or code of practice other than those listed above has been employed, judgement of the adequacy of the installation can only be assessed on an individual basis, taking account of the current condition of the installation. Relevant Legislation, ACOP and Guidance includes: Offshore Installations (Safety Case) Regulations 2005 Offshore Installations and Wells (Design and Construction, etc) Regulations 1996 Assessment Principles for Offshore Safety Cases [APOSC] 4. Specific Technical Issues: Hazards to structural integrity arise from three principal sources, namely:
3.
Accidental events, ie fire, explosions, blowout, boat impact, helicopter/ aircraft impact and dropped objects Natural events, ie extreme weather, fatigue failure, corrosion, marine growth, scour and seismic events. Management system inadequacies, ie poor fabrication procedures, topsides overloading, change of use/structural modification, inadequate system management procedures, inadequate design and inadequate inspection, repair and maintenance during fabrication and operation.
37
There is a need to consider that different approaches to the management of structural integrity may be required, depending on:
Whether the installation is manned or normally unmanned. The age of the installation and the codes and standards that it has been designed to.
For ageing installations, it is important to place special emphasis on the knowledge and understanding of the integrity. 5. Other Related Assessment Sheets in this Section are: 3.G1-3.G4, 3.G12, 3.G13: Environmental hazards 3.G8, 3.G9, 3.G10, 3.G14, 3.G15, 3.G16: Accidental hazards 3.G5-3.G7, 3.G17-3.G22: Management system hazards 3.F13.F8 Risk evaluation 3.F13.F5 Frequency 3.F63.F8 Consequences 3.F93.F23 Risk management measures: 3.F93.F14 Inherent safety 3.F153.F19 Prevention 3.F203.F23 Mitigation 6. Cross-Referenced Sections and Sheets are: None 7. Lead Assessment Section for this Sheet: OSD5.1: Jack-up installations OSD5.2: Fixed installations OSD5.3: Semi submersible installations/ship shaped/floating installations 8. Team responsible for authoring and updating this sheet: OSD5.2
38
3.G1: 3.G2: 3.G3: 3.G4: 3.G11: 3.G12: 3.G13:

1.
Extreme Weather, including Wave-In-Deck Loading Fatigue Failure Corrosion Marine Growth Foundation Failure Scour Seismic Event
Confirmation should be obtained that installations have been designed and constructed, and/or re-assessed, maintained and repaired in accordance with the latest edition of a recognised standard, recommended practice or code of practice for accidental hazards. General requirements for accidental hazards are found in: ON27 Status of Technical Guidance on Design, Construction and Certification OTO 2001 013 Loads ISO 19901-1 Petroleum and Natural Gas Industries - Specific Requirements for Offshore Structures Part 1: Metocean Design and Operating Considerations ISO 19901-3 Petroleum and Natural Gas Industries - Specific Requirements for Offshore Structures Part 3: Topsides Structure ISO 19901-5 Petroleum and Natural Gas Industries - Specific Requirements for Offshore Structures Part 5: Weight Control During Engineering and Construction ISO 19902 Petroleum and Natural Gas Industries - Fixed Steel Offshore Structures ISO 19903 Petroleum and Natural Gas Industries - Fixed Concrete Offshore Structures SNAME T&R Bulletin 5-5A 1994 Society of Naval Architects & Marine Engineers (SNAME) Recommended Practice for Site-specific Assessment of Mobile Jack-up Units
2.
Where a standard, recommended industry/company practice or code of practice other than those listed above has been employed, judgement of the adequacy of the installation can only be assessed on an individual basis, taking account of the current condition of the installation. Relevant Legislation, ACOP and Guidance includes: Offshore Installations (Safety Case) Regulations 2005 Offshore Installations and Wells (Design and Construction, etc) Regulations 1996 Assessment Principles for Offshore Safety Cases [APOSC]
3.
4.
Specific Technical Issues: 4.1 Extreme Weather [Initiator 3.G1]
The installation must be designed to ensure that it can withstand extreme loading, based on the use of appropriate metocean data. In accordance with ISO 19901-1 the air gap
39
assessment philosophy should be based on the principle that the deck height should be chosen such that the frequency of wave impact on the deck is compatible with the target failure rate of the substructure. The use of a load and resistance factor design methodology requires that extreme waves do not cause major structural damage with an annual failure probability exceeding 10-4. The structure should remain capable of withstanding the 100-year environmental load without progressive collapse in the damaged condition. In both the 10,000-year [intact] and 100-year [damaged] scenarios, load and resistance factors of unity are to be used. 4.2 Fatigue Failure [Initiator 3.G2]
The consequences of fatigue failure, which is defined as the occurrence of a through thickness crack, can be very serious and fatigue life is therefore an important structural integrity performance criterion for offshore structures. The principal sources of guidance on the prediction of fatigue life are OTO 2001 015, NORSOK N-004 and ISO 19902. However, there is considerable uncertainty in the assessment process and cracking can occur within the design life. The fatigue assessment should include consideration of the effects of the principal causes of fatigue damage, ie

4.3
fabrication defects, including weld root defects damage from pile driving followed by fatigue, for fixed steel platforms as well as special factors, eg single-sided closure welds ring-stiffened joints high strength steels [generally defined as steels with a yield strength exceeding 400 MPa] Corrosion [Initiator 3.G3]
The consequence of corrosion is loss of member thickness, leading to reduced static strength, buckling capacity and possible local structural collapse. It is common practice to provide a 'corrosion allowance' for members located near mean sea level [often between 6 -12 mm] where corrosion rates are higher. Steel exposed to sea spray is also vulnerable and in the splash zone epoxy or similar paints are often used to provide corrosion protection, since the CP system is ineffective in this zone. Overprotection [ie potentials more negative than -1100mV Ag/AgCl] can be damaging to fatigue [ie it can increase fatigue crack growth rates significantly] and to epoxy or similar coatings, with the possibility of bonding to the steel being lost. Hence, design of the anode system is important to minimise this effect and regular monitoring of potentials is also essential to reduce this problem in practice. Guidance can be found in OTO 2001 011. 4.4 Marine Growth [Initiator 3.G4]
The marine growth allowance should be specified in the safety case and controlled to ensure that the loading on the structure is maintained within the design limits or remedial action is undertaken. 4.5 Foundation Failure [Initiator 3.G11]
The design adequacy of foundations is demonstrated by use of an appropriate standard or equivalent associated with that type of installation, [ISO 19901-4, ISO 19902, ISO 19903, SNAME T&R Bulletin 5-5A]. The safety case should give measures to ensure that the design capacity does not deteriorate to a level whereby foundation instability and failure
40
occurs. For situations where soils are known to be weak some monitoring of deck level may be appropriate to provide a means whereby this may be controlled. Interaction of foundations with wells, well drilling or footprints should be assessed. 4.6 Scour [Initiator 3.G12]
The safety case should specify the allowable scour and means by which the actual scour is monitored. Remedial activity should be specified where necessary. 4.7 Seismic Events [Initiator 3.G13]
Duty holders should be able to demonstrate that structures have a low probability of catastrophic failure when subjected to earthquakes and that supports of both safety critical plant and equipment are sufficiently robust to withstand the accelerations, displacements and relative deflections caused. The emphasis of the assessment is that the primary control of the seismic hazard is inherent safety, achieved by the ability of structures and equipment supports to withstand seismic forces and vibrations through adequate design with suitable safety factors [eg to the 200-year return period] and a subsequent check to a longer return period [eg to the 10,000-year return period]. Equipment safety is provided by appropriate specification and attention to vulnerability of supports. The implications of acceleration, displacement and deflection for the integrity of Safety Critical Elements also need to be considered. See ISO 19901-2. 5. Other Related Assessment Sheets in this Section are: 3.HS1 3.HS2 3.HS3 3.HS5 6. Fixed Steel Installations Fixed Concrete Installations Semi Submersible Installations Jack-Up Installations
Cross Referenced Sections and Sheets are: Section 4.1 Section 4.2 Section 6 Section 10 Section 11 Loss of Maritime Integrity - Loss of Stability Loss of Maritime Integrity - Loss of Position Wells Emergency Response Human Factors
7.
8.
41
3.G5: 3.G6: 3.G7: 3.G17 3.G18: 3.G19: 3.G20: 3.G21: 3.G22:

1.
Poor Fabrication Procedures/Materials Defects/ Materials Failure [Brittle Fracture] Topsides Overloading Change of Use/Structural Modification Inadequate Management System Procedures Inadequate Design Inadequate Inspection, Repair & Maintenance During Fabrication and Operation Inadequate Re-assessment Inadequate Verification Operator Error
Confirmation should be obtained that installations have been designed and constructed, and/or re-assessed, maintained and repaired in accordance with the latest edition of a recognised standard, recommended practice or code of practice for management system hazards. General requirements for accidental hazards are found in: ON27 Status of Technical Guidance on design, Construction and Certification ISO 19901-1 Petroleum and Natural Gas Industries - Specific Requirements for Offshore Structures Part 1: Metocean Design and Operating Considerations ISO 19901-2 Petroleum and Natural Gas Industries - Specific Requirements For Offshore structures Part 2: Seismic Design Procedures and Criteria ISO 19901-3 Petroleum and Natural Gas Industries - Specific Requirements for Offshore Structures Part 3: Topsides Structure ISO 19901-5 Petroleum and Natural Gas Industries - Specific Requirements for Offshore Structures Part 5: Weight Control During Engineering and Construction ISO 19902 Petroleum and Natural Gas Industries - Fixed Steel Offshore Structures EEMUA 158 Construction Specification for Fixed Offshore Structures in the North Sea HS(G)65 Successful Management of Health and Safety CSWIP Certification Scheme for Welding and Inspection Personnel or equivalent
2.
Where a standard, recommended industry/company practices or code of practice other than those listed above has been employed, judgement of the adequacy of the installation can only be assessed on an individual basis, taking account of the current condition of the installation. Relevant Legislation, ACOP and Guidance includes: Offshore Installations (Safety Case) Regulations 2005 Offshore Installations and Wells (Design and Construction, etc) Regulations 1996
3.
42
Assessment Principles for Offshore Safety Cases [APOSC] 4. Specific Technical Issues: 4.1 Fabrication Procedures [Initiator 3.G5]
For new installations or platform reuse, fabrication defects are a major cause of fatigue failure in offshore structures and consequently a principal mechanism for the control of fatigue failure is the thorough inspection for weld defects during fabrication. Defects detected during fabrication should be repaired. They may be allowed to remain only where it can be demonstrated that they do not compromise the integrity of the structure. Further information is given in EEMUA 158. Studies have shown that significant defects [ie up to 5 mm in height] can be present. Although such defects would normally be repaired, the detection of defects in this size range is close to the limits of current inspection techniques for this kind of defect and the integrity assessment should take this into account. 4.2 Topsides Overloading [Initiator 3.G6]
Evidence of the structures ability to withstand foreseen changes in the topsides loading is required. This may include weight monitoring procedures see ISO 19901-5. Careful consideration needs to be given to the ability of the structure to withstand changes in the topsides loading. Appropriate weight monitoring procedures should be complemented by component and system strength assessments to ensure that the design limits of the structure are not exceeded during its operational life. 4.3 Change of Use/Structural Modification [Initiator 3.G7]
Any change of use affecting the original design [eg variation of the topsides loading and change of process requirements] and any structural modification require a reassessment of the structural integrity to ensure that the operational limits are not exceeded. 4.4 Management System Procedures [Initiator 3.G17]
The duty holder must implement adequate system management procedures to ensure that the risk of structural failure is maintained at an acceptable level. Reference should be made to the requirements of HS(G)65. Competence is an essential requirement in the management of structural integrity and is now recognised in the suite of ISO structural standards. The need for suitably qualified personnel in all aspects of structural integrity management, eg offshore structural engineering and inspection planning, is specified. Assessors should ensure that suitably qualified personnel to CSWIP or equivalent are designated. 4.5 Design [Initiator 3.G18]
The Offshore Installations and Wells (Design and Construction, etc) Regulations 1996 (DCR) place a requirement on the duty holder to design installations to withstand such forces acting on it that are reasonably foreseeable and that in the event of foreseeable damage it will retain sufficient integrity to enable action to be taken to safeguard the health and safety of personnel on or near it so far as is reasonably practicable. The application of good practice is one of the key measures with respect to structural integrity risk management in demonstrating compliance with these regulatory requirements, with particular emphasis on the setting of performance standards [see Verification, 3.G21] and the provision of adequate safety margins against failure from major hazards. This requires the use of appropriate standards for the design of offshore structures. Where an installation designed under the previous certification regime does not show the same level
43
of safety as newer structures, the duty holder should demonstrate that it meets the relevant DCR requirements. 4.6 Inspection, Repair & Maintenance During Fabrication & Operation [Initiator 3.G19]
Inspection Planning Methodologies Structural inspection is a key factor in providing data for the management of structural integrity. For North Sea structures on the UKCS, preparation of an inspection plan is a requirement of Regulation 8 of DCR. This requires the duty holder to ensure that suitable arrangements are in place for maintaining the integrity of the installation. This entails the quantification/identification of the risk of structural failure and the subsequent formulation of a suitable cost-effective inspection schedule to enable the targeting of critical components. The inspection programme should include a thorough fabrication inspection [see 3.G5], a baseline inspection once the platform has been installed, the collation and evaluation of platform and inspection data, periodic inspections to monitor any deterioration [eg from fatigue] and special inspections following any accidental damage or extreme loading events to determine whether there is a need for any remedial work in the event of damage or deterioration. Reference should be made to the ISO standard for offshore inspection (ISO 19902), for both in-service inspection and structural integrity management. The plan should contain information to demonstrate that the accidental hazards are within the design limits. It is important that the plan takes into account the effects of structural redundancy in setting targets with a contingency that shows an awareness that unexpected failures may occur in practice, which will not be predicted using current probabilistic techniques. Inspection Techniques A number of different inspection techniques are used during fabrication and operation. The case should either refer to or describe appropriate inspection techniques. Standard techniques applied in the fabrication yard include UT, MPI and sometimes RT. The use of FMD as the principal inspection method applied to primary and secondary members in steel jacket structures accepts that significant damage must occur for the damage to be detected and hence total reliance on FMD is not necessarily sufficient to ensure structural integrity. It is therefore necessary that this approach is complemented with rigorous structural integrity assessment and management. Repairs The ability of a repair to restore the integrity of a fatigue damaged component is a necessary requirement in maintaining the overall integrity of an offshore structure. Several different repair methods can be used offshore. They involve weld repair, structural modification or the use of strengthening techniques. Methods used include:
normal welding for above water repairs hyperbaric weld repair [underwater] removal of cracks by grinding with or without subsequent re-welding drilling of crack arrester holes member removal or replacement addition of strengthening members joint reinforcement using gusset plates internal grouting of members and joints
44
use of grouted and mechanical clamps
There is a continuing need for regular inspection of repaired components as part of the overall inspection of the structure. 4.7 Re-assessment [Initiator 3.G20]
Where structures have come to the end of the design life or suffered significant damage, reassessment of the structural integrity should be performed to demonstrate that existing installations continue to meet regulatory requirements. The principal sources of guidance on reassessment are ISO 13822, ISO 19902 and NORSOK. The safety case should demonstrate the criteria for reassessment ISO 19901 and 19902:
extension of service life beyond the original calculated design life damage or deterioration of a primary structural component change of use that violates the original design or previous integrity assessment departures from the original basis of design [eg increased loading or inadequate deck height] original design criteria are no longer valid
as well as the versions of the design codes used. Many installations have been designed to earlier versions of structural codes and standards which have subsequently been updated to reflect improved knowledge and experience. Hence, design criteria based on the original version of the code may now be unconservative and no longer valid and reassessment is necessary. In-service inspection practices will determine the nature and extent of the reassessment process to demonstrate structural integrity. Hence, the reassessment process needs to take into consideration the changes in inspection practices that have taken place in recent years as these have implications on the approach to structural integrity assessment. When it is shown that the structure is not acceptable by analysis then strengthening or repairs may be required to demonstrate that measures have been or will be taken to ensure compliance with DCR. When this is not possible operational limits may be needed on the platform [eg demanning when extreme weather is imminent]. The adequacy of fatigue life for the intended remaining life should also be reviewed and this should be taken into account when planning repairs and future inspection schedules. Ageing Installations Ageing is characterised by deterioration which is caused mainly by fatigue and corrosion. Any structural deterioration due to ageing should be taken into account in the reassessment process. It is therefore important to have accurate knowledge of both the condition of a structure with respect to fatigue and corrosion and knowledge of the response of the structure to the ageing process for effective structural integrity assessment. Knowledge of the design specification and the damage state may not always be available for ageing structures. Safety margins during reassessment need to be increased in such circumstances. It is therefore important that good records of both design details and changes in the structural condition [due to in-service damage and deterioration] are maintained. 4.8 Verification [Initiator 3.G21]
45
Verification is a key process in the overall SIM as a result of DCR. This includes the identification and risk management of Safety Critical Elements (SCE). In general, the whole jacket is considered to be a SCE and other SCEs include the topsides, temporary refuge and helideck. For each SCE, performance standards need to be developed, providing a statement of the performance required of the system and which is used as a basis for managing the particular hazard through the lifecycle of the installation. 4.9 Operator Error [Initiator 3.G22]
The assessment should take into consideration the possibility of the introduction of enhanced risk resulting from operator error, particularly in areas of weight growth or ships collision. 5. Other Related Assessment Sheets in this Section are: 3.HS1 3.HS2 3.HS3 3.HS5 6. Fixed Steel Installations Fixed Concrete Installations Semi Submersible Installations Jack-Up Installations
Cross Referenced Sections and Sheets are: Section 7 Section 10 Section 11 Diving Emergency Response Human Factors
7.
Lead Assessment Section for this Sheet: OSD5.1, OSD5.2 and OSD5.3.
8.
46
3.G8: 3.G9: 3.G10: 3.G14: 3.G15: 3.G16:

1.
Fire Explosion Blowout Boat Impact Helicopter/Aircraft Impact Dropped Objects
Confirmation should be obtained that installations have been designed and constructed, and/or re-assessed, maintained and repaired in accordance with the latest edition of a recognised standard, recommended practice or code of practice for accidental hazards. General requirements for accidental hazards are found in: ON27 Status of Technical Guidance on Design, Construction and Certification OTO 2001 013 Loads ISO 19902 Petroleum and Natural Gas Industries - Fixed Steel Offshore Structures ISO 19903 Petroleum and Natural Gas Industries - Fixed Concrete Offshore Structures ISO 19904 Petroleum and Natural Gas Industries - Floating Offshore Structures NORSOK S001 Technical Safety NORSOK Z-001 Documentation for Operation NORSOK Z-013 Risk and Emergency Preparedness Analysis SCI Technical Note No 4 Explosion Resistant Design for Offshore Structures
2.
Where a standard, recommended industry/company practice or code of practice other than those listed above has been employed, judgement of the adequacy of the installation can only be assessed on an individual basis, taking account of the current condition of the installation. Relevant Legislation, ACOP and Guidance includes: Offshore Installations (Safety Case) Regulations 2005 Offshore Installations and Wells (Design and Construction, etc) Regulations 1996 Assessment Principles for Offshore Safety Cases [APOSC]
3.
4.
Specific Technical Issues: 4.1 Fire [Initiator 3.G8]
The structural response of equipment, TR supports and primary structure from fires identified in the case should be assessed to the Steel Construction Institutes Interim Guidance Notes on fire & explosion [IGN]. 4.2 Explosions [Initiator 3.G9]
47
The structural response and escalation potential from explosions identified in the case should be assessed to the IGN. 4.3 Blowout [Initiator 3.G10]
Refer to Section 6 Wells for potential of this hazard. 4.4 Boat impact [Initiator 3.G14]
The structural response from boat impact should be assessed - see Section 2 Vessel Impact. 4.5 Helicopter/Aircraft Impact [Initiator 3.G15]
The structural response from helicopter/aircraft impact should be assessed - see Section 8 - Helicopter Crash. 4.6 Dropped Objects [Initiator 3.G16]
The structural response to dropped objects should be assessed. Normal engineering principles should have been applied taking account of the size and weight of objects identified in the case. 5. Other Related Assessment Sheets in this Section are: 3.HS1 3.HS2 3.HS3 3.HS5 6. Fixed Steel Installations Fixed Concrete Installations Semi Submersible Installations Jack-Up Installations
Cross Referenced Sections and Sheets are: Section 2 Section 5.1 Section 5.3 Section 8 Section 10 Section 11 Vessel Impact Loss of Containment - Process Loss of Containment - Fire & Explosion Helicopter Crash Emergency Response Human Factors
7.
8.
48
3.F1: 3.F2: 3.F3: 3.F4: 3.F5: 3.F6: 3.F7: 3.F8:

1.
Hazard Studies [HAZOPs etc] Generic Historical Data Installation Specific Data IVB Data Reliability Analysis Extent of Structural Damage/Failure Reduced Redundancy, Remaining Residual and Reserve Strength Remaining Fatigue Life
Confirmation should be obtained that risk evaluation has been carried out in accordance with industry guidelines and is based on recognised risk data sources, for example: CMPT A Guide to QRA for Offshore Installations UKOOA Guidelines for QRA Uncertainty UKOOA Guidelines Formal Safety Assessment DnV Guidelines for Offshore Structural Reliability Analysis
2. 3.
Where industry guidance and data sources other than those listed above have been used then the duty holder will need to justify the validity of other sources of guidance and data. Relevant Legislation, ACOP and Guidance includes: Offshore Installations (Safety Case) Regulations 2005 Offshore Installations and Wells (Design and Construction, etc) Regulations 1996 Assessment Principles for Offshore Safety Cases [APOSC]
4.
Specific Technical Issues: 4.1 Hazard Studies [Initiator 3.F1]
It is not normal engineering practice to perform discrete hazard studies. ISO 19000 [General Requirements] lists the hazards that are considered in the more specific standards in the ISO series. 4.2 Generic Historical Data [Initiator 3.F2]
Historical data is usually inappropriate to determine the loss of integrity frequency although some cases may try and use this approach. If used the appropriateness [type of structure, geographical location] of the data should be assessed. 4.3 Installation-Specific Data [Initiator 3.F3]
Reliable and comprehensive structural data are an essential requirement for the structural integrity assessment of an installation during its life cycle. The case should give an account of this deterioration. 4.4 IVB Data [Initiator 3.F4]
49
See 3.F3 Installation-specific data 4.5 Reliability Analysis [Initiator 3.F5]
If the case uses a reliability approach, good practice is to be found in the DnV guidelines for offshore structural reliability analysis. A recent initiative, Advanced Structural Reliability Network (ASRANET), has been set up to encourage the integration of reliability analysis with advanced structural analysis in an attempt to provide more accurate and realistic measures of failure and hence provide some technical basis for dealing with ageing infrastructures. CONSEQUENCES [3.F63.F8] Loss of structural integrity can have serious consequences, depending on the redundancy, component strength, system strength and fatigue life. The safety case should therefore contain evidence that foreseeable structural damage to the installation, escalation potentials and all likely scenarios have been considered. 4.6 Extent of Structural Damage/Failure [Initiator 3.F6]
The case should indicate:

4.7
whether there is any existing damage or local failure the assessment has taken this into account to ensure the appropriate integrity. Redundancy, Residual & System Strength [Initiator 3.F7]
Existing codes and standards are based on satisfying component adequacy and hence structures are normally designed on a component basis. However, fixed offshore platforms generally have a multiplicity of load paths so that failure of one component does not necessarily lead to catastrophic structural collapse. The implementation of an effective structural integrity management system requires the application of system strength analysis to provide an understanding of the performance of the structural system. Thus, should the duty holder wish to optimise the design and inspection procedures, full consideration should be given to the performance of a systems analysis to quantify the reserve and residual capacities, now recognised as the key parameters in managing integrity, and the identification of critical components in the structure. Platform configuration is a key factor to be considered in assessment. X braced panels are more 'ductile' in that they offer alternative load paths compared to, for example, K bracing where once a member fails there is no alternative load path through the frame. Thus, the potential reduction in static strength of a joint in K-based framing is likely to be more damaging than a cracked joint in X-braced framing and this needs to be reflected in the level of assessment of system strength. 4.8 Remaining Fatigue Life [Initiator 3.F8]
For welded joints in offshore structures, the fatigue life N3 is defined as the point at which a through-thickness crack forms. However, actual failure will occur when the load bearing capacity of the remaining ligament is insufficient for the applied load and this is designated N4. At this stage load shedding will take place and the applied loads will be transferred to neighbouring components. The reliance on FMD in maintenance strategies for offshore installations requires that the inspection interval is such that N4 is not exceeded. The available information indicates that the remaining fatigue life on penetration of the wall thickness may be rather limited. It is therefore important that due consideration is given in the development of the structural
50
integrity management plan to the possibility of total member failure occurring after penetration of the wall and of the consequences to structural integrity. 5. Other Related Assessment Sheets in this Section are: 3.HS1 3.HS2 3.HS3 3.HS5 6. Fixed Steel Installations Fixed Concrete Installations Semi Submersible Installations Jack-Up Installations
Cross Referenced Sections and Sheets are: Section 11 Section 12 Section 13 Human Factors Human Vulnerability QRA
7.
8.
51
3.F9:
Concept Selection
3.F10: Use of Best Design Practice 3.F11: Use of Suitable Safety Factors 3.F12: High Redundancy - Inherent Safety 3.F13: Optimum Materials and Fabrication Procedures 3.F14: Maintenance Management Procedures 3.F15: Sufficient Air Gap for 10,000-year Storm 3.F16: Suitable Safety Factors [Fatigue, Applied Loading, Pile loads etc] 3.F17: High Redundancy - Prevention 3.F18: Maintenance and Repair Management Procedures 3.F19: Control Measures [Management/Structural] for Accidental Loads 3.F20: Suitably Rated Fire and Blast Walls/Use of PFP etc 3.F21: Maintenance & Repair Management Procedures 3.F22: System Management Procedures for Accidental Loads 3.F23: High Redundancy Mitigation
1. Confirmation should be obtained that risk evaluation has been carried out in accordance with industry guidelines and is based on recognised risk data sources, for example: CMPT A Guide to QRA for Offshore Installations UKOOA Guidelines for QRA Uncertainty UKOOA Guidelines Formal Safety Assessment HS(G)65 Successful Management of Health and Safety 2. 3. Where industry guidance and data sources other than those listed above have been used then the duty holder will need to justify the validity of other sources of guidance and data. Relevant Legislation, ACOP and Guidance includes: Offshore Installations (Safety Case) Regulations 2005 Offshore Installations and Wells (Design and Construction, etc) Regulations 1996 Assessment Principles for Offshore Safety Cases [APOSC] 4. Specific Technical Issues: Inherent Safety [3.F9-3.F14] 4.1 Concept Selection [Initiator 3.F9]
52
The integrity of the concept selected should be of a level which is ensured by following the latest standards. If reuse is part of the concept, the assessment must consider loss of deterioration and fatigue in previous uses as well as evidence of the actual condition of the structure. 4.2 Use of Best Design Practices [Initiator 3.F10]
Design best practice is to be found in the latest editions of standards. 4.3 Use of Suitable Safety Factors [Initiator 3.F11]
Standards stipulate safety factors. These are generically suitable but in some cases special consideration of alternative safety factors may be made. The rationale behind such consideration should be examined. 4.4 Redundancy [Initiator 3.F12]
Adequate component integrity is achieved through appropriate material selection and design for static strength and fatigue capacity [complemented by an appropriate level of inspection during fabrication for weld defects and in service for defects, corrosion and marine growth]. A fundamental requirement for the design of offshore installations with the required level of inherent safety is the use of best design practice. The principal documents for the structural design of offshore installations operated on the UKCS are the appropriate parts of API RP 2A [at least 18th Edition] and the emerging ISO documents supplemented by information outlined in ON27. Many installations have been designed to earlier versions of structural codes and standards which have subsequently been updated to reflect improved knowledge and experience. Hence, design criteria based on the original version of the code may be unconservative and no longer valid and reassessment is necessary. 4.5 Optimum Materials and Fabrication [3.F13]
Most offshore structures are constructed from weldable medium strength steels [usually grade 50D], for which codes and standards exist, eg BS 7191. Welding procedures are now well developed for the medium strength steels used offshore and are well codified, eg EEMUA 158 and AWS D1.1. More recently, newer higher strength steels, with a better strength to weight ratio, are being used increasingly. However, in general there is less test data available to support the design equations and the duty holder should ensure that sufficient and reliable data are available to enable a structural integrity assessment with an appropriate level of confidence. Inspection at the fabrication stage is recognised as a major part of the reliability aspect of performance standards and there is a need for this to be well documented for proper life cycle efficiency. 4.6 Maintenance Management Procedures/Structural Inspection & Condition Monitoring [Initiator 3.F14]
Structural inspection is a key factor in providing data for the management of structural integrity. For North Sea structures on the UKCS, preparation of an inspection plan is a requirement of DCR Regulation 8. This requires that the duty holder ensures that suitable arrangements are in place for maintaining the integrity of the installation, through periodic assessments and carrying out any remedial work in the event of damage or deterioration. The inspection programme includes:
a baseline inspection once the platform has been installed periodic inspections to monitor any deterioration [eg from fatigue]
53
special inspections following any accidental damage or extreme loading events.
A set of default inspection requirements is included, with prescriptive survey periods for cases where an inspection plan has not been produced. The inspection planning methodology should demonstrate an understanding of the significance of the analytical information requirement and the inspection strategy implementation. Normal underwater inspection programmes include a condition survey of the anodes, the extent of marine growth and corrosion potential monitoring of areas of the jacket structure. Through this, anodes can be identified and subsequently replaced to ensure an adequate level of cathodic protection is provided for the life of the structure. Prevention [3.F15-3.F19] 4.7 Sufficient Air Gap for 10,000-year Storm [Initiator 3.F15]
ISO 19900 specifies that the air gap assessment philosophy should be based on the principle that the deck height should be chosen such that the frequency of wave impact on the deck is compatible with the target failure rate of the substructure. The NPD approach, which is applicable to the UKCS, is based on a load and resistance factor design methodology and requires that extreme waves do not cause major structural damage with an annual failure probability exceeding 10-4. It is considered acceptable for load damage to occur provided that the structure remains capable of withstanding the 100-year environmental load without progressive collapse. In both the 10,000-year [intact] and 100year [damaged] scenarios, load and resistance factors of unity are to be used. 4.8 Suitable Safety Factors [Fatigue, Applied Loading, Pile Loads, etc] [Initiator 3.F16]
An important requirement in traditional deterministic approaches to engineering design is the selection of appropriate safety factors, eg on fatigue life, the applied loading, the pile loads, etc. A major calibration exercise has been performed on the ISO standard for offshore structures in order to derive consistent values for partial safety factors [PSFs] for actions & resistance, based on a selected target reliability. The target reliability is commonly taken to be the implied probability of structural failure in codes & standards which are judged to be acceptable. For offshore structures, the system target reliability based on extreme wave system reliability, ignoring fatigue analysis, has been used. 4.9 High Redundancy [Initiator 3.F17]
High redundancy is redundancy that is significantly more than that enshrined in the latest standards. Claims for this should be examined with a view to establishing common load paths and the adequacy of bracing giving the higher than standard redundancy. 4.10 Maintenance and Repair Management Procedures [Initiator 3.F18]
See 3.G17 Inadequate Management Systems Procedure. 4.11 Control Measures [Management/Structural] for Accidental Loads [Initiator 3.F19]
The management system should ensure that the installation retains sufficient structural integrity in the event of accidental damage so that the overall risk is maintained at an appropriate level. Mitigation [3.F203.F23] 4.12 Suitably Rated Fire & Blast Walls [Initiator 3.F20]
A significant amount of work [including full scale testing] has been undertaken concerning the science and engineering of fire and explosion loads and effects on offshore structures.
54
The design and reassessment framework for this work is currently being considered as the industry moves to standardise and harmonise matters associated with these hazards. Topsides structures are sensitive to fire and explosions and consequently it is important to model steel panels realistically. The strengthening of structures to enable them to withstand large explosions requires a better understanding of ultimate capacity performance and escalation prediction. This requires understanding of and data on high temperature and strain rate effects on materials plasticity and fracture behaviour. 4.13 High Redundancy [Initiator 3.F23]
See 3.F12 Redundancy. 5. Other Related Assessment Sheets in this Section are: 3.G1 6. Extreme Weather including Wave-In-Deck Loading
Cross Referenced Sections and Sheets are: Section 2 Section 5.1 Section 5.3 Section 7 Section 8 Section 10 Section 11 Section 13 Vessel impact Loss of containment - Process Loss of containment - Fire & Explosion Diving Helicopter Crash Emergency Response Human Factors QRA
7.
8.
55
4.1 LOSS OF MARITIME INTEGRITY - LOSS OF STABILITY

1. Scope This Section provides guidance for the assessment of safety case content with respect to the loss of stability of an installation, from hazard identification through to consequence determination, including risk management measures. The installation types [source of hazard] are categorised by hull form as:

2.
Jack-Ups Semi-submersible Units Monohulls [includes FPSO, FSU, Drillships, Well intervention vessels] Other hull forms [eg TLPs, Spar buoys]
Assessment of Adequacy of Demonstration Any loss in the stability of the installation is defined as a major accident in Regulation 2 of the Offshore Installations (Safety Case) Regulations 2005 [SCR]. For the purpose of this Section and safety case assessment this is interpreted as any unplanned change in the floating stability of the installation. This might be due to a variety of reasons which include, but are not restricted to: collision with another vessel, failure of the watertight integrity, internal flooding from pipework, operation of installations drench and firefighting system, human errors in deck loading and ballast distribution, movement of deckload, failure or unexpected loads on mooring line, excessive loads on derrick, or exceedence of design environmental parameters. The categorisation table in this Section presents a number of prompts or keywords for the initiators that might lead to a loss of stability [the causal chain]. The initiators have been divided into 5 categories as:
Design Operational Hardware Interface Systems Human Factors External Events
The categorisation table also shows keywords for the evaluation of the escalation path [the consequence chain]; how the risk is evaluated in terms of both frequency and consequence. Similarly keywords are presented for the risk management measures that can be introduced, these cover the complete range of possible measures and are:
Inherent Safety Prevention Detection Control
56
Mitigation Evacuation, Escape and Rescue [EER]
The assessor should examine the adequacy of the hazard identification, risk evaluation and management measures as described in the safety case in conjunction with the contents of the categorisation table below. 3. Depth of Assessment This section gives guidance on the depth of assessment required to determine the adequacy of the demonstration that measures have been or will be taken to ensure compliance with the relevant statutory provisions. Where the safety case contents match with good practice identified herein, there will usually be no need for an assessor to probe into the details of how the good practice is applied. This may, however, be a suitable issue to follow up through inspection. Stability is fundamental to the motion responses of an installation. The motion characteristics are important design inputs for the design of installation plant and equipment, weather dependent activities and the effects on personnel. It is important that these motion characteristics are adequately assessed at the design stage for any installation. A list of references is found at the end of this Section. These are the main references that should be familiar to, and consulted by, the assessor. They are not a complete list of references on the subject of loss of stability.
57
4. The Assessor should examine the adequacy of the hazard identification, risk evaluation and management in conjunction with the contents of the Categorisation Table below:
Loss of Maritime Integrity - Loss of Stability Source of Hazard
HS1 HS2 HS3 HS4 Jack-Ups Semi Subs Monohulls Other Types G1
Initiators
Design Assessment Hull subdivision Watertight structure Piping systems Weight management Codes and standards Specification/ dimensions G2 Operational Hardware Section 3 Overload Fatigue Material defect Construction defect Commissioning defect Maintenance defect Corrosion/ erosion F1 F2 F3 F4 F5 F6 F7 F8 F9 F10 F11 F12 F13
Risk Evaluation
Frequency Generic data Company data Classification Society ISO/IMO standards HAZOP studies FMECA studies Personnel policies Selection Section 11 Training Section 11 Competency Section 11 Concept design Operations procedure Maintenance policies F35 F36 F37 F38 F39 F31 F32 F33 F34 F30

Inherent Safety Not afloat [jack-up]
Intact stability Damage stability Ballast systems
Prevention Sub division Collision resistant Isolation valves Bilge alarm systems
Marine competency
Detection CCTV Flood detection Inspection procedures Draft, trim, heel indicators Tank gauging system
58
Loss of Maritime Integrity - Loss of Stability Source of Hazard

G3
Initiators
Interface systems Electric controls Section 5.1 Hydraulic controls Pneumatic controls UPS/power generation G4 Human Factors Section 11 Operations deficiency Training Competency Communication Incorrect action G5 External Events Fire/explosion Section 5.3, & Section 9 Firefighting water Over/under pressure F14 F15 F16 F17 F18 F19 F20 F21 F22 F23 F24 F25
Risk Evaluation
Consequences Stability design codes Marine systems design Redundancy Flexibility of operation Subdivision Damage extent Trim/heel/draft Motions Hydrocarbon containment Section 5.1 Progressive flooding Cargo movement Structural collapse Section 3 Additional environmental load EER impairment Section 10 F47 F48 F44 F45 F46 F41 F42 F43 F40

Bilge alarm system
Control Emergency response plan Training simulators Damage control
Mitigation Counterballast Support vessels Towage/salvage
Emergency Response
F26 F27
Non essential [Helicopter] Emergency [TEMPSC]
59
Loss of Maritime Integrity - Loss of Stability Source of Hazard Initiators

Sabotage/terrorism Dropped object Section 3 Severe environment Section 3 Moorings failure Section 4.2 Collision/ grounding Section 2 Power failure Section 5.1 F28 F29
Risk Evaluation
Personnel mobility Section 12 Panic Section 12 F49

Keep within limits
60
4.1.HS1 4.1.HS2 4.1.HS3 4.1.HS4 4.1.G1-G5 4.1.F1-F29 4.1.F30-49

1.
Jack Ups Semi Subs Monohulls Other Types Initiators Risk Evaluation Measures Risk Management Measures
The assessor should obtain confirmation that the risk of loss of stability has been fully assessed. Both intact and damage stability criteria and environmental loads are to be used in the assessment. This in practice means that the installation is designed, constructed, operated and maintained in accordance with HSE standards. In general, HSE standard of performance is defined in the former 4th Edition, see Operations Notice ON27, and in particular referencing OTO 2001-049. There are particular points that require further attention, and these are listed in the bullet points that follow in this Section. The risk assessment approach should follow one of the techniques described in guidance document OTO 2001-063. Where there is not compliance with the above assessment standards the duty holder should demonstrate that there is an equivalent level of performance, with regard to the loss of stability, obtained by the use of some other internationally recognised standard. HSE recognise that the standards of the Norwegian Maritime Directorate [NMD] are broadly equivalent to HSE required performance standard. The assessor should obtain confirmation that the installation is fully compliant with the NMD Mobile Offshore Unit [MOU] Code. Any qualifications to the NMD approval should be investigated to HSE satisfaction to confirm acceptance of the safety case. Compliance only with either the International Maritime Organisation [IMO] codes for Mobile Offshore Drilling Units [MODU Code], or the Code for Special Purpose Ships are not equivalent to the HSE requirements. Further risk assessments will be required and possible modifications to subdivision and piping arrangements. Each installation will be considered on an individual basis. Relevant Legislation, ACOP and Guidance includes: Offshore Installations (Safety Case) Regulations 2005, Regulations 12(1)(c); 12(1)(d); Schedule 3 Offshore Installations and Wells (Design and Construction, etc) Regulations 1996, Regulations 5, 8, 9
4.
Specific Technical Issues All Installation Types For all installation types, the safety case will be required to demonstrate to the assessor, directly or by reference to other documents, that:
61
An acceptable standard of watertight integrity is achieved in the design of the installation. The risk of accidental flooding has been properly assessed with regard to both frequency and consequence of this accidental event The piping and control systems are capable of control of the flooding and restoring the installation to stable equilibrium. The risk of loss of the control system has been adequately assessed, and that loss of the main control system will not lead to a loss of stability. There are suitably qualified personnel for the operation and maintenance of the marine equipment essential to vessel stability and watertight integrity. The components of the marine systems essential to watertight integrity have been defined as safety critical elements and are included in the verification scheme.
Jack-Up Units The following points are particularly relevant to jack-up units and require to be addressed in the safety case:
Procedures and systems for maintenance of watertight integrity during in-field and ocean transit. Procedures for marine operations on approach and departure from adjacent installations. Pre-load procedures. Compliance with Safety Notice 2/2001. Compliance with SPC/TECH/OSD/21.
Semi-Submersible Units The following points are particularly relevant to semi sub units and require to be addressed in the safety case:
Effect of moorings and thrusters on stability. Adequate de-ballasting system or secondary system, capable of developing adequate suction with vessel at maximum inclined angle after damage. Ability to de-ballast with a flooded pump room.
Monohull Units The following points are particularly relevant to FPSO/FSUs and require to be addressed in the safety case:
Adequate freeboard, or other protection, against the effects of green water loading. Suitable procedures for the maintenance of stability during the offloading of cargo to shuttle tanker. Risk of collision with the shuttle tanker minimised due to suitable equipment and procedures. Compliance with Safety Notice 4/2003.
62
5.
6.
Cross-Referenced Sections and Sheets are: Section 2 Section 3 Section 4.2 Section 5.1 Section 5.2 Section 5.3 Section 6 Section 10 Section 11 Section 12 Section 13 Vessel Impact Structural Integrity Loss of Maritime Integrity - Loss of Position Loss of Containment - Process Loss of Containment - Pipelines Loss of Containment - Fire and Explosion Wells Emergency Response Human Factors Human Vulnerability QRA
This Section has been cross-referenced by the following Sections and Sheets: Sheet 5.1.F8 Section 7 Section 8 7. Safety Integrity Levels Standards Diving Helicopters
Lead Assessment Section OSD5.4
8.
63
Annex 1 LIST OF REFERENCES The following sources of general guidance are useful, but are not to be taken as a complete list of references on the assessment of loss of stability: Operations Notices ON27 Safety Notices SN 04/2003 SN 01/2003 SN 02/2001 Reducing the Risks Associated With Flooded Machinery Spaces on Monohull FPSO and FSU Installations Ageing semi-submersible installations Jack-up [self elevating] installations: floating damage stability survivability criterion Status of technical guidance on design, construction and certification
Semi-Permanent Circulars SPC/TECH/OSD/24 Accident/Incident Data SPC/TECH/OSD/21 The Safe Approach, Set-up and Departure of Jack-up Rigs to Fixed Installations SPC/TECH/OSD/17 Report by the OSD Working Group into P36 Incident SPC/TECH/OSD/04 SPC/ENF/68 Collision Risk Management Advice to Inspectors Risks Associated with Flooded Machinery Spaces on Monohull FPSO and FSU Installations
HSE Research Reports RR049 RR095 RR143 OTO 2001-010 OTO 2001-011 OTO 2001-012 OTO 2001-013 OTO 2001-048 OTO 2001-049 OTO 2001-051 OTO 2001-063 OTO 2001-065 Review of the Jack-Ups: Safety in Transit [JSIT] technical working group Accident statistics for floating offshore units on the UK Continental Shelf 19802001 Review of the risk assessment of buoyancy loss [RABL] project Environmental considerations Corrosion protection Site Investigations Loads Floating Installations Stability, Watertight integrity and ballasting Self-elevating installations [jack-up units] Marine Risk Assessment Mechanical equipment
64
OTO 2000-097 OTO 2000-123 OTO 1999-092 OTO 1998-045 OTH 1994/434 Other Sources DNV OS-C301 UKOOA UKOOA UKOOA HSG 48
Rationalisation of FPSO design issues Review of model testing requirements for FPSOs Human factors assessment of safety critical tasks Quantified Risk Assessment of Jack-Up Operations Afloat Criteria for jack-ups manoeuvring in close proximity to jacket platforms
DnV Offshore Standard Stability & Watertight Integrity Guidelines for Safe Movement of Self-Elevating Offshore Installations (Jack-Ups), April 1995 FPSO Design Guidance Notes for UKCS Service Guidelines for Selection and Training of Ballast Control Operators
Reducing error and influencing behaviour
65
4.2 LOSS OF MARITME INTEGRITY - LOSS OF POSITION

1. Scope This section provides guidance for the assessment of safety case content with respect to the loss of position of any floating installation. The scope ranges from hazard identification through to consequence determination, including risk management measures. Position may be lost through either a failure of the mooring system, or a failure of the dynamic positioning system. 2. Assessment of Adequacy of Demonstration Loss of position of a floating installation can easily lead to collision with an adjacent installation, or to the release of hydrocarbons from fractured drilling or well operations risers. Hence, loss of position is clearly a hazard with the potential to cause a major accident and requires evaluation within the safety case [SCR Regulation 12(1)(c), d)]. Loss of position is an incident that is reportable under the Offshore Installation and Wells (Design and Construction, etc) Regulations 1996 [DCR] as well as more generally in the application of Reporting of Injuries, Diseases and Dangerous Occurrences Regulations 1995 (RIDDOR) offshore. The categorisation table in this section presents a number of prompts or keywords for the initiators that might lead to a loss of position [the causal chain]. The initiators have been divided into five categories as:
Design Operational Hardware Interface Systems Human Factors External Events
The categorisation table also shows keywords for the evaluation of the escalation path [the consequence chain]; how the risk is evaluated in terms of both frequency and consequence. Similarly keywords are presented for the risk management measures that can be introduced, these cover the complete range of possible measures and are:
Inherent Safety Prevention Detection Control Mitigation Evacuation, Escape and Rescue [EER]
The assessor should examine the adequacy of the hazard identification, risk evaluation and management measures as described in the safety case in conjunction with the contents of the categorisation table below.
66
3.
Depth of Assessment This section gives guidance on the depth of assessment required to determine the adequacy of the demonstration that measures have been or will be taken to ensure compliance with the relevant statutory provisions. Where the safety case contents match with good practice identified herein, there will usually be no need for an assessor to probe into the details of how the good practice is applied. This may, however, be a suitable issue to follow up through inspection. A list of references is found at the end of this section. These are the main references that should be familiar to, and consulted by, the assessor. They are not a complete list of references on the subject of loss of stationkeeping. Two sources of hazard: the mooring system and the dynamic positioning system are identified in the Categorisation Table. These are dealt with separately in the following assessment sheets 4.1HS1 [Moorings] and 4.2HS2 [Dynamic Positioning]. Thruster assisted mooring systems are included in the assessment of the mooring systems.
67
Loss of Maritime Integrity - Loss of Position Source of Hazard
HS1 Mooring System Anchor Chain Wire Fairleads Stopper Winches Control system Section 5 Turret Turret bearings G2 Operational Hardware Overload Fatigue Section 3 Material defect Section 5.1 Manufacturing defence HS2 Dynamic Positioning Reference sensors Commissioning defect Maintenance defect F8 F9 F10 Consequences Collision Section 2 HC release Section 5.1 Motions outside of limits G1
Initiators
Design Assessment Environmental Forces Section 3 Seismic/erosion Incorrect specification Uncontrolled modifications F1 F2 F3 F4 F5 F6 F7
Risk Evaluation
Frequency Generic data System specific data Emergency tow Support vessels Incident response time Proximity to other hazards Maintenance programme F22 F23 F24 F25 F17 F18 F19 F20 F21

Inherent Safety Redundancy in design Water depth Excursion radius Flexible riser Weathervaning
Classification societies IMCA/NMD/API standards Material specification Software specification Audit reports Client standards Personnel competency
Prevention Redundancy Tension meters Weather forecasts Standby power
68
Loss of Maritime Integrity - Loss of Position Source of Hazard

Thrusters Power management and generation Section 5 Computer software Hydrodynamic model G3 Interface systems Electric controls Hydraulic controls Pneumatic controls UPS/power generation
Initiators
F11 F12 F13 F14 F15 F16
Risk Evaluation
Emergency Response required Section 10 HELO Ops impaired Section 10 Tilt/trip Noise/vibration Section 12 Riser damage Section 5.2 Turret drag chain F26 F27 F28 F29

Detection Tension meters Position monitoring Position alarms Other vessels
Control G4 Human Factors Section 11 Incorrect operation Poor ergonomics Inadequate training Low competence Deficient procedures F33 F34 G5 External Events Emergency response action Emergency Response Mitigation Alert Coastguard Emergency tow F30 F31 F32 Emergency response Monitor movement Shutdowns
69
Loss of Maritime Integrity - Loss of Position Source of Hazard Initiators

Fire Section 5.3, Section 9 Explosion Section 5.3 Gas release Section 5.1, Section 6 Trawler/external disturbance
Risk Evaluation
F35

Precautionary Section 11
70
4.2.HS1 4.2.G1-G5 4.2.F1-F16 4.2.F17-F35

1.
Mooring System Initiators Risk Evaluation Risk Management Measures
The assessor should obtain confirmation that the mooring system is designed, constructed, operated, and maintained in accordance with recognised standards. In general, HSE standard of performance is defined in the former 4th Edition, see Operations Notice ON27. Reference may also be made to Classification Society Rules, and the associated Class Notation [eg POSMOOR Code from Det Norske Veritas, and Offshore Standard OSE301]. The assessor should be satisfied that the appropriate design rules have been selected to suit the operating environment for the installation safety case.
2.
Where there is not compliance with the above assessment standards the duty holder should demonstrate that the mooring system would have an equivalent level of performance. HSE recognise that the standards of the Norwegian Maritime Directorate [NMD] are broadly equivalent to HSE required performance standard. In addition to the Classification Society Rules, there is also much useful information obtainable from the American Petroleum Institute [API] as well as various industry working parties and associated publications [JIP publications]. These are listed in Annex 1 List of References at the end of this section. Relevant Legislation, ACOP and Guidance includes: Offshore Installations (Safety Case) Regulations 2005 Regulations 12(1)(c); 12(1)(d); Schedule 3 Offshore Installations and Wells (Design and Construction, etc) Regulations 1996, Regulations 5, 8, 9
3.
4.
Specific Technical Issues The safety case will be required to demonstrate to the assessor, directly or by reference to other documents, that:
Appropriate standards have been used for the mooring equipment. The hazard assessment includes the loss of a mooring line, or mooring system component, and further evaluation of this by quantitative risk assessment where necessary. The mooring system components are included as safety critical elements where this is appropriate, with performance standards defined for these elements. There is a mooring integrity monitoring system with an appropriate performance standard for the detection of a failed mooring line within an acceptable timescale. This particularly applies to FPSOs and other installations that remain on station for prolonged periods. Inspection and maintenance requirements are defined for the safety critical components of the mooring system.
71
There are personnel with a defined level of competency, and responsibility for the operation and maintenance of the mooring system. The proximity to other installations, including requirements for gangway access, has been fully considered in the assessment. There is adequate clearance of the mooring lines from any sub-surface equipment, obstructions, or pipelines. There are suitable emergency procedures, mitigation measures, and drills to deal with events such as a lost mooring line. Procedures exist for the adjustment of line tension that may be required prior to periods of heavy weather, or to offset the installation for operational requirements. Operation of the mooring system is possible from control stations without hazard to personnel. Emergency release of the moorings is possible [such as during a sub sea blowout] so that move off location is possible without main power generation being available. The availability of emergency release system has been assessed and riser disconnect and cargo handling considered when applicable. Suitable stand-off location for combined operations is defined. The risk assessment approach should conform to the requirements contained in guidance document OTO 2001-063.
Thruster-Assisted Mooring System In addition to meeting the specific technical issues listed above, the following points will also require to be demonstrated to the satisfaction of the assessor:
A clear definition of the control mode ie manual, or automatic thruster assist. Appropriate selection of the consequence class and the safety factors for the marine operation to be undertaken. Availability of a back-up control for the thruster if main communication/ control link fails. Thorough assessment of possible failure modes and corrective actions required [eg full pitch thruster failure]. Assessment of the thruster availability and the required redundancy in the control system. Inclusion of the thrusters, power system, control system, and reference system as safety critical elements [SCEs] and with appropriate performance standards and verification scheme. Suitable maintenance of thruster system as required for an SCE of a positional mooring system.
5.
Other Related Assessment Sheets in this Section are:
72
None 6. Cross-Referenced Sections and Sheets are: Section 2 Section 3 Section 4.1 Section 5.1 Section 5.2 Section 5.3 Section 6 Section 10 Section 11 Section 12 Section 13 Vessel Impact Structural Integrity Loss of Maritime Integrity - Loss of Stability Loss of Containment - Process Loss of Containment - Pipelines Loss of Containment - Fire and Explosion Wells Emergency Response Human Factors Human Vulnerability QRA
This section has been cross-referenced by the following sections and sheets: Sheet 5.1.F8 Section 7 Section 8 7. Safety Integrity Levels Standards [Mooring release/Riser disconnect/Cargo handling] Diving Helicopters
8.
73
4.2.HS2 4.2.G1-G5 4.2.F1-F16 4.2.F17-F35

1.
Dynamic Positioning Initiators Risk Evaluation Risk Management Measures
The assessor should obtain confirmation that the dynamic positioning system is designed with respect to redundancy in accordance with recognised standards, for example IMO MSC circular 645, or equivalent Classification Society Rules. The safety case should also demonstrate that for any particular DP operation the equipment class of the vessel has been decided based upon a risk assessment on the consequences of a loss of position. Reference should also be made to IMCA M103, or Petroleum Safety Association Activities Regulations, section 81, for suitable examples. Where there is not compliance with the above standards, the duty holder should demonstrate that the dynamic positioning system would have an equivalent level of performance with respect to single point failures, including fire and flooding of machinery spaces. The safety case should demonstrate that requirements under the Management of Health and Safety at Work Regulations 1999 (MHSWR) are complied with including suitable and sufficient risk assessment encompassing planning of DP operations, communications, competency, and decision-making.
2.
3.
Relevant Legislation, ACOP and Guidance includes: Offshore Installations (Safety Case) Regulations 2005, Regulations 12(1)(c); 12(1)(d); Schedule 3 Offshore Installations and Wells (Design and Construction, etc) Regulations 1996, Regulations 5, 8, 9
4.
Specific Technical Issues The safety case will be required to demonstrate to the assessor, directly or by reference to other documents, that:
Appropriate standards have been used for the dynamic positioning system. All modes of operation have been considered in the assessment of hazards. These will include diving operations, well operations, riser excursion limits, and proximity to other installations, control of heading for FPSO offload. Each type of operation will have its own hazards and associated risks. The interface of the DP system with any thruster-assisted mooring system has been adequately assessed. Operation of the DP system in conjunction with any interface requirements for emergency riser disconnects, mooring release, or cargo handling operations has been suitably considered. Maximum excursion limits and environmental operating restrictions are clearly defined.
74
A Failure Modes and Effects Analysis [FMEA] is available and represents the current DP configuration, and conforms to IMCA management guidance for FMEAs. [Under development as at June 2004, but refer also to RR195] There are records of annual DP proving trials, or other proving trials at frequencies determined by the Verification Scheme. The Safety Critical Elements [SCEs] required by the safety case include the DP system, and important elements of the power generation and management system. Inspection and maintenance requirements are defined for the safety critical components of the DP system. Suitable records of the training and experience of DP qualified personnel are maintained. Any changes, repairs, or modifications to the DP system are properly managed and controlled. There is a system for reporting of DP faults and the subsequent action taken to rectify them. Operating limits in terms of environment, thrusters, power generation, control equipment etc. are developed prior to the DP operation. Operating guidelines specific to the particular DP operation to be undertaken.

5.
Related Assessment Sheets in this Section are: None
6.
Cross-Referenced Sections and Sheets are: Section 2 Section 3 Section 4.1 Section 5.1 Section 5.2 Section 5.3 Section 6 Section 10 Section 11 Section 12 Section 13 Vessel Impact Structural Integrity Loss of Maritime Integrity - Loss of Stability Loss of Containment - Process Loss of Containment - Pipelines Loss of Containment - Fire and Explosion Wells Emergency Response Human Factors Human Vulnerability QRA
This section has been cross-referenced by the following sections and sheets:
75
Sheet 5.1.F8 Section 7 Section 8 7.
Safety Integrity Levels Standards [Mooring release/Riser disconnect/Cargo handling] Diving Helicopters
8.
76
Annex 1 LIST OF REFERENCES The following sources of general guidance are useful, but are not to be taken as a complete list of references on the assessment of loss of position: Operations Notices ON27 Safety Notices SN 3/2005 Floating Production Storage and Offloading (FPSO) Mooring inspection Status of technical guidance on design, construction and certification
Semi-Permanent Circulars SPC/TECH/OSD/24 Accident/Incident Data SPC/ENF/50 SPC/ENF/107 Reporting of Mooring Failures Floating Production Storage and Offloading Mooring inspection
HSE Research Reports RR219 RR195 RR095 OTO 2001-010 OTO 2001-011 OTO 2001-012 OTO 2001-013 OTO 2001-050 OTO 2001-063 OTO 2001-065 OTO 2000-026 OTO 2000-053 OTO 2000-065 OTO 2000-097 OTO 2000-123 OTO 1999-066 OTO 1999-092 Design and integrity management of mobile installation moorings Review of methods for demonstrating redundancy in dynamic positioning systems for the offshore industry Accident statistics for floating offshore units on the UK Continental Shelf 1980 2001 Environmental considerations Corrosion protection Site Investigations Loads Stationkeeping Marine Risk Assessment Mechanical equipment Appraisal of AP1RP 2F for Floating Production System Collision resistance of ship-shaped structures to impact Development of the concept of structural toughness rationalisation of FPSO design issues Review of model testing requirements for FPSOs Effects of motion on cognitive performance Human factors assessment of safety critical tasks
77
OTH086
Quick release systems for Moorings
Other Sources Moorings Classification Society [DnV, LR, ABS, BV] Rules DnV OS-E301 IMO Circ 737/1995 AP1 RP Spec 2F AP1 RP 2fps AP1 RP 2SK AP1 RP 2I AP1 RP2SM AP1 RP 2T Position mooring Guidelines on anchoring equipment Mooring Chain Recommended Practice for Planning, Designing and Constructing Floating Production Systems Design and Analysis of Station keeping Systems for Floating Structures Inservice Inspection of Mooring Hardware for Floating Drilling Units. Recommended Practice for Design, Manufacture, Installation and Maintenance of Synthetic Fiber Ropes for Offshore Mooring Planning, Designing, and Constructing Tension Leg Platforms
Other Sources Dynamic Positioning Classification Society [DnV, LR, ABS, BV] Rules IMO Guidelines MSC Circ 645/1994 MSC Circ 738/1995 IMCA M103 IMCA M166 IMCA M161 IMCA M 159 IMCA M 150 IMCA M 117 115 DPVOA 112 UKOOA In particular from Marine safety Committee [MSC] Guidelines for Vessels with Dynamic Positioning Equipment Guidelines on training requirements Guidelines for the Design and Operation of Dynamically Positioned Vessels Guidance on failure modes and effects analyses [FMEAs] Guidelines for the Design and Operation of Dynamically Positioned Vessels: Two-Vessel Operations: A Supplement to IMCA M103 Guidance on Thruster-Assisted Stationkeeping by FPSOs and Similar Turret-Moored Vessels Quantified Frequency of Shuttle Tanker Collision during Offtake Operation The training and Experience of Key DP Personnel Risk analysis of collision of dynamically positioned support vessels with offshore installations [Revised] UKOOA Publications of joint initiatives Guidelines for Offshore Installations Safety Case Diving Operations from Vessels Guidelines for Auditing Vessels with Dynamic Positioning Systems DP Position loss risks in shallow water Diving Operations from Vessels operating in DP mode
DPVOA 1611/14 IMAC D010
78
Other Sources General UKOOA UKOOA NPD/NMD HSEG48 ISO 1990 1-7.E.3 FPSO Design Guidance Notes Tandem Loading Guidelines Guidelines and NORSOK Standards Reducing error and influencing behaviour Petroleum and Natural Gas Industries specific requirements for offshore structure Part 7: stationkeeping systems for floating offshore structures and mobile offshore units; under development as at June 2004
Joint Industry Projects [JIP] have been conducted in a number of areas. Information on these is the property of the participants, but in a number of cases this information is becoming publicly available. JIPs have been conducted with the following parties as principal contact and in subject areas: DNV Noble Denton Noble Denton BMT/Noble Denton Reliability based design for Deepwater Moorings Integrated Riser and Mooring Design Studless Chain Corrosion Fatigue Response based design of FPSOs
79
5.1 LOSS OF CONTAINMENT - PROCESS

1. Scope This section provides guidance for the assessment of safety case content with respect to the loss of containment from process plant and process operations, from hazard identification through to elements of consequence determination, including risk management measures. However it excludes assessment of the consequences of ignition of any release. This is considered separately in Section 5.3. 2. Assessment of Adequacy of Demonstration The evaluation of risk that might stem from each major accident hazard is to be assessed by identification of the factors that might result in an adverse combination of a source of hazard and initiator, together with identification and evaluation of escalation paths that might result. Potential sources of hazard, initiators etc, are shown in Section 4 below. Assessors should ensure that, where relevant, safety cases contain appropriate consideration of each of these factors. 3. Depth of Assessment This section gives guidance on the depth of assessment required to determine the adequacy of the demonstration that measures have been or will be taken to ensure compliance with the relevant statutory provisions. Where safety case contents match with good practice identified in the assessment sheets for a particular element associated with a major accident, there will usually be no need for an assessor to probe into the details of how the good practice is applied. This may, however, be a suitable issue for follow-up by inspection.
80
Loss of Containment - Process Source of Hazard
HS1 Pressure Vessels [inc Columns] HS2 HS3 Heat Exchangers Atmospheric Vessels [eg Wemcos, TPSs] HS4 Centrifuges/ Hydrocyclones HS5 HS6 HS7 HS8 HS9 Piping Smallbore tubing Pipeline Risers Flexible hoses Pumps G1 G2 G3 G4 G5 G6 G7 G8 G9 G10 G11
Initiators
Corrosion: Internal/External Erosion Overpressure Internal explosion Under pressurisation Fatigue/vibration cracking Fire Seal failure Turret failure Inadequate installation Operator error: inadequate Training F4 F5 F6 F7 F1 F2 F3
Risk Evaluation
Frequency Generic historical data Company & installation data Installation specific hazard studies - HAZOPs - FMEAs F14

Inherent Safety - fully rated vessels, pipework, pipelines, risers, etc - large segregation distances - separate accommodation jacket - inventory minimisation
Vessels, pipework, Flexible hoses
tubing tanks, risers/ Temperature & drains/caissons Temp & pressure rating pressure rating Material specification
Material specification Corrosion allowance Corrosion allowance Fatigue life Fatigue life Frequency of inspect
- Design reviews Layout Company standards/procedures Corrosion/erosion policy Operational reviews [procedures] F15 F16 F17 Prevention Relief systems HIPS systems Blowdown/flare systems
Frequency of inspect Integrity of connectors Relief arrangements & capacity Reliability of protective systems Pumps, Compressors Turbines Flow rate
81
Loss of Containment - Process Source of Hazard

HS10 HS11 HS12 HS13 Compressors Turbines Valves Deck Drains [inc tote tanks and Chemical injection tanks] HS14 HS15 Marine storage tanks Hazardous drains /caissons HS16 HS17 HS18 HS19 Integral storage cells Flare towers Turrets Temporary Equipment G21 G16 G17 G18 G19 G20 G15 G13 G14 G12
Initiators
Operator error: inadequate competency Violation Deficient procedures: operational Deficient procedures: maintenance Ship collision Dropped object Seismic event Missile [eg turbine blade] Ageing/mechanical degradation External loads [eg stood on, struck by F12 F11 F10 F8 F9
Risk Evaluation
SIL standards Equipment selection [eg weld or Flange] Concept selection F18 F19 F20

Shutdown systems Alarms/Trips Good procedures - operational
Adequacy of supports Fire protection Heat Exchangers Thermal rating Temp & pressure rating Head/pressure Shut-in pressure NPSH Turndown Minimum flow Sealing system
- maintenance
Shell & tubeside Flow rates
Consequences Size of release
F21 F22
Competent personnel Monitoring & audit systems
Material specification Valves Fatigue life Temperature &
Frequency of inspect pressure rating -speed & effectiveness of detection & response - blowdown system Dispersion - open/closed modules/ventilation F24 F25 Detection Gas detection Fire detection Centrifuges/ Hydrocyclones F23 Isolations and PTW controls Relief arrangements Material specification & capacity Corrosion allowance Closure mode Fire protection Integrity of seals
82
Loss of Containment - Process Source of Hazard Initiators

scaffold pole] G22 G23 G24 Helicopter collision/rollover Inadequate design Incorrect material specification G25 G26 G27 G28 G29 Incorrect material usage Thermal radiation Slugging/water hammer Sloshing/slam liquid loads Structural failure F13
Risk Evaluation
rates Toxicity of release Ignition transfer to fire & explosion Section 5.3
Temp & pressure rating Material specification Corrosion allowance Turrets Separation efficiency Temperature & Vibration [centrifuges] pressure rating Leakage rate
Flare/Vent Systems Material specification Temp & pressure rating Corrosion allowance
Material specification Integrity of seals Corrosion allowance Seal leaking rate Separation efficiency Gas dispersion Thermal radiation Noise level Turndown
83
5.1.HS1: 5.1.HS5: 5.1.HS12:
Pressure Vessels (Including Columns) Piping and Piping Components Valves
[Relevant Sheets: 5.1.G17, 5.1.G18, 5.1.G20, 5.1.G21, 5.1.G29, 5.1G3, 5.1.G5, 5.1.G6, 5.1.G8, 5.1.G10, 5.1.G27, 5.3.F15, 5.3.F18] 1. This sheet is generally applicable to the mechanical integrity of static components that form the boundary of a hydrocarbon containment system; ie pressure vessels and piping etc. It is also of relevance to rotating equipment, in so far as these also have pressure boundaries. Aspects specific to machinery and rotating equipment are dealt with elsewhere. Similarly, process control and plant isolation requirements are not dealt with here. This sheet is not intended to limit the scope of an assessor to pursue any aspect of safety that they believe is important to a particular safety case, within the remit provided by the safety case regulations. It is though intended to provide guidance as to the minimum acceptable demonstration of safety that a duty holder should be able to provide. As with all safety assessment work, there is a need for HSE assessors to concentrate on areas where there are grounds for believing the safety demonstration may be weakest. Knowledge of such areas comes from HSEs collective experience, as well as that of the wider engineering community. This document is intended to provide pointers towards what are believed to be the most pressing concerns. Conversely, it is not considered necessary or practical for a particular safety case to mention explicitly all of the aspects of design and operational concerns identified below. However the duty holder should in principle be able to address all such concerns and hence provide an adequate demonstration of integrity. Therefore, it is reasonable for an assessor to question a duty holder on any aspect of the integrity justification. Confirmation should be obtained that the pressure system elements have been designed, constructed, installed, and operated in accordance with a recognised standard or code of practice. As a general principle, HSE accepts that codes, standards published by BSI, ASME, API and others, are for the most part well founded, in that they have been written to encompass the present best knowledge and advice available. However adherence to a code is not in itself a demonstration of safety. There are several reasons for this. Not only are some codes inherently goal oriented themselves, but there are also some matters which are the subject of technical uncertainty, or indeed where current code provisions appear to be inadequate or may not reflect the state of the art. The safety case assessment process may therefore include questioning as to the detailed application or adequacy of parts of codes. A typical, but non-exhaustive, list of standards and codes of practice would include: PD5500:2003 Specification for unfired fusion welded pressure vessels ASME VIII Boiler and pressure vessel code BS EN 13445 Unfired pressure vessels ASME B31.3 Process piping ISO13703 [API 14E] Petroleum and natural gas industries. Design and installation of piping systems on offshore production platforms ISO 15649 Petroleum and natural gas industries. Piping
84
PD CEN/TR 14549 2004 Guide to the use of ISO 15649 and ANSI/ASME B31.3 for piping in Europe in compliance with the Pressure Equipment Directive ISO 14692 Parts 1 to 4 Petroleum and natural gas industries. Glass-reinforced plastics (GRP) piping. BS 4994 Specification for design and construction of vessels and tanks in reinforced plastics Codes to assist in-service integrity: A typical but non-exhaustive list of relevant standards would include: ASME Boiler and Pressure Vessel Code Series Inspection: API 510 Pressure vessel inspection code: Maintenance inspection, rating, repair, and alteration API 570 Piping Inspection Code: Inspection, repair, alteration, and rerating of in-service piping systems API 574 Inspection practices for piping system components EEMUA Standards API RP 580 Risk based inspection API 581 Risk based inspection Flaw assessment: BS 7910 Guide on methods for assessing the acceptability of flaws in metallic structures Fitness for purpose: API 579 Recommended practice for fitness-for-service and continued operation of equipment The emerging ASME Post Construction codes are likely to provide useful benchmarks for inspection planning, flaw evaluation, repair, and testing. 2. Where a standard or code of practice other than those listed above has been employed, judgement as to the adequacy of alternative measures can only be assessed on an individual basis, and the duty holder should be required to provide an engineering justification of how an equivalent level of health and safety performance is delivered. The avoidance of loss of containment relies primarily on the integrity of the containment in which the hydrocarbons are held. The issue of mechanical integrity can itself be subdivided into issues of initial integrity and continuing integrity. 2.1 Initial integrity
Adequate initial integrity is delivered by adherence to suitable design principles, often embodied in codes and standards. Full consideration should be taken of design details, operating and fault conditions, material properties and potential failure modes. Related issues include the provision of protective systems. Delivery of the design intent is provided by suitable quality controls on manufacture followed by appropriate inspection and testing. Adequate initial integrity is ensured by adherence to the following engineering principles.
85
Risks implicit in the design should be identified. [APOSC 91] Engineering design should seek to minimise risk and adopt a hierarchical approach [APOSC 92 & 98] Appropriate industry standards should be used. Engineering structures important to safety should maintain their integrity through life, requiring a demonstration that normal operating loads and foreseeable extreme loads have been quantified. The materials used should be suitable. [APOSC 95] Active safety features should have demonstrably adequate reliability, availability and survivability In-service Integrity

2.2
Following a consideration of the initial integrity, attention must be turned to the continuing integrity of the containment, throughout its service life. This is ensured by; operating the plant within the limits for which it was designed; by carrying out appropriate maintenance and through periodic examination by a competent person, to identify significant inservice degradation. Also, procedures must be in place to ensure that modifications to the plant will not compromise the integrity of the containment. Finally, the duty holder needs to be sure that the assumptions made at the design stage are still valid. For example, a change of usage may lead to faster corrosion/erosion rates and different applied loads may invalidate the design fatigue assessment. 3. Relevant Legislation, ACOP and Guidance includes: Offshore Installations (Safety Case) Regulations 2005, Regulations 12(1)(c) & 12(1)(d) & Schedules Offshore Installations (Prevention of Fire and Explosion, and Emergency Response) Regulations 1995, Regulations 9 and 19 Provision and Use of Work Equipment Regulations 1998, Regulations 4, 5 and 6 Lifting Operations and Lifting Equipment Regulations 1998, Regulations 8 and 9 Pressure Equipment Regulations 1999, Regulations 7 and 10 Assessment Principles for Offshore Safety Cases [APOSC] 14, 16, 35, 41, 91, 92, 95, & 98 4. Specific technical issues Relevant initiators and potential failure mechanisms are identified below: 4.1 Primary & Secondary Loads
Primary loads typically include design pressure and self-weight etc. Secondary loads typically include thermal loads and equipment displacements etc. Adherence to the relevant design codes and standards should ensure that the pressure systems are adequately designed for primary and secondary loads. 4.1.1 Overpressure [Initiator 5.1.G3]
Pressure system should be designed for maximum and, where relevant, the minimum anticipated operating pressure under all modes of operation. It needs to be borne in mind that the maximum operating pressure may not occur during the normal mode of operation.
86
Designing equipment and systems to the maximum pressure to which it can be subjected can have advantages in simplifying plant by reducing or eliminating protection or relief systems. Based on established design pressures, the facilities should be protected with recognised relief devices discharging to suitable disposal or an instrumented high integrity protection system or a combination of both. The latter subject is covered in 5.1.F16. Possible sources of overpressure need to be identified and allowed for. Issues for Safety Case Assessment It should be established whether provision against over pressurisation is provided by active measures, such as pressure relief and control systems, or is dependent upon the strength of the component itself. Later in life, plant changes may necessitate reassessment. When overpressurisation is a foreseeable event, the consequences should be considered. The nature of the failure should be determinable, ie whether a leak or a catastrophic failure could result. Further assessment of consequence could include assessment of the hazards posed by any release. 4.1.2 Risers and Topsides Pressure Rating [Initiator 5.3.F15]
It is normal practice in offshore industry to use different design codes for the design of topside piping and risers. Risers are normally designed to pipeline design codes, such as BS 8010 and topside piping is normally designed to piping code ASME B31.3. Both the codes use different factor of safety in the design of pressure systems for primary and secondary loads. Hence it is important that at the specification break between riser and topside piping the pressure rating on both sides, ie riser and topside, is compatible. Issues for Safety Case Assessment It should be established that specification break made between topside piping and a riser is made at appropriate location so that the design requirements of respective design codes are satisfied. 4.1.3 Under-Pressurisation [Initiator 5.1.G5]
Underpressure events also have the potential to cause failures i.e. by implosion if the under-pressure that results is below atmospheric pressure [vacuum conditions]. Normally, integrity is assured by adherence to a recognised design code. 4.1.4 External Loads and Structural Support Failure [Initiators 5.1.G21 & 5.1.G29]
Lack of consideration of pipe supports and movement of piping and connected equipment at the design phase can result in failure of supports, leakage at flanged joints and overloading of sensitive equipment such as pumps and compressors etc. External loads could come from a disturbance of the structure itself, ie a partial failure or relative displacements. External movements may result from vessel movements [FPSO] or wind sway, eg piping supported from a tall slender tower or temperature changes in connected equipment. Loads due to such movements need to be considered and adequate flexibility should be provided within the pipework. For floating vessels, the motion may well contribute significantly to the fatigue load Issues for Safety Case Assessment Confirmation that external loads acting on the pressure system have been considered and allowed for in the mechanical design. 4.1.5 Inadequate Installation [Initiator 5.1.G10]
87
Inadequate installation of plant is a significant source of engineering failure. Deficiencies include misalignment of mating parts, incorrect welding and jointing procedures, inadequate inspection, and the omission of certain parts of the overall commissioning process, such as pressure testing. Commissioning procedures should be in place to ensure that installed pressure equipment is inspected before use to identify any design faults that may have been introduced at the construction stage and to confirm suitability for use. Issues for Safety Case Assessment Does the duty holder have an effective safety management system for installation and modification of plant. 4.1.6 Seismic Event [Initiator 5.1.G18]
If seismic events are deemed a possibility, then in principle the effects can be included as a design load case. In such a situation, the response of the structure will have been calculated and the resultant motion would have to be imposed on the hydrocarbon containment system. Issues for Safety Case Assessment Whether seismic assessment has been carried out at the design stage. 4.2 Occasional Loads
These include slugging, water hammer, wind, sloshing and liquid slam, etc [5.1.G27 & 5.1.G28]. During design, the operation of each piping system needs to be clearly understood not only under normal conditions but also those conditions arising during start up, shutdown and as a result of process upsets. The dynamic loads produced by the movement of fluids within a pressurised system can be considerable. Excitation from valve slams or from flow instabilities has been known to be a source of severe vibration. Issues for Safety Case Assessment The safety case should make it clear that occasional loads have been considered during the design phase. 4.3 4.3.1 Degradation in Service Corrosion
Please refer to generic sheets 5.1.G1 Parts 1 & 2 & 5.1.F6. Piping containing hydrocarbons should avoid 'dead legs' and be designed to facilitate drainage to prevent trapping of fluid. 4.3.2 Erosion
Please refer to generic sheets 5.1.G2 & 5.1.F6. 4.3.3 Fatigue/Vibration Cracking [5.1.G6]
Fatigue is a damage mechanism by which cracks can propagate in a structure under the influence of repeated cycles of stress well below the level capable of causing general yielding. Fatigue is often characterised as occurring in two phases, the first is that of initiation, ie from manufacture up to the point where a detectable crack is present. The
88
second is the phase of defect growth, where propagation from the point of detectability to the point of failure occurs. Fatigue is addressed initially at the design stage. There are a number of methodologies by which this can be done. However we note that for plant with a limited fatigue load, the codes normally provide for the exclusion of a full analysis, providing that certain preconditions can be met, ie it is established that there will only be a limited number of full pressure cycles etc. In general though, the fatigue loads from all sources of repetitive stress have to be characterised both in terms of the stress amplitude and their number. This can be used to determine a fatigue lifetime for the component. Issues for Safety Case Assessment The importance of fatigue as a potential failure mechanism varies greatly according to the type of duty a pressure vessel or piping system is subjected to. However, in an environment where installations are increasingly being used beyond its original design lifetime, there are important issues as to whether the plant is still within its original fatigue life. For older plant, the duty holder could be questioned as to the current validity of the original fatigue calculations. Experience has shown that fluid induced vibration is a significant cause of failure in offshore pressure systems, affecting both vessels and piping. Such type of vibration is perhaps somewhat difficult to treat within design codes. Further guidance on this topic is provided in: JIP Report MTD Guideline for the Avoidance of Vibration Induced Fatigue in Process Pipework; and OTR Report 2002/28 Transient Vibration Guidelines for Fast Acting Valves Screening Assessment. It is a reasonable question to ask how the duty holder assures the integrity of plant against this source of fatigue. 4.3.4 Seal/Gasket/Compression Fitting Failure [5.1.G8]
A suitable demonstration should be provided for the integrity of joints and seals where failure could lead to a release of hydrocarbons. General information should be provided to indicate that flanges and other joints have been adequately designed and properly made to avoid flammable and toxic hazards. Further guidance is available in IP/UKOOA Guidelines for the Management of Integrity of Bolted Pipe Joints. 4.3.5 Fully Welded Topside Pipework in Critical Areas [5.3.F18 & 5.1.F9]
The use of fully welded pipework topside is one of the approaches to adhere to the principle of inherently safer design. However, for ease of access for operation, inspection, maintenance and repairs, it is not possible to have fully welded pipework everywhere on topside plant. The duty holder should avoid routing of pipework containing hazardous fluid through non hazardous area. If this is unavoidable then pipework shall be all welded [no flanges] and not located in a vulnerable position where it may be mechanically damaged. Issues for Safety Case Assessment It should be established in the safety case that as far as possible hydrocarbon pipework in non-hazardous areas is fully welded. 4.4 Materials
89
Materials chosen should be suitable for the application in terms of the process fluid, environment and applied loading. 4.4.1 Incorrect Material Specification
Please refer to 5.1.G24 regarding issues relating to incorrect material specification. Issues relating to incorrect material usage [5.1.G25] are addressed by ensuring that pressurised equipment is designed and manufactured in accordance with a recognised design standard as indicated in Section 1above. 4.4.2 Brittle Fracture
The prevention of brittle fracture is addressed within design codes. Prevention involves the correct choice of materials, operation within strict temperature/pressure limits and monitoring ageing phenomena such as embrittlement. Ferritic steels are subject to a ductile to brittle transition as temperature decreases, rendering them highly vulnerable to brittle fracture when cold. Transition temperatures vary, but are typically below ambient values for offshore applications. Ageing though can lead to a shift in the transition temperature and render components more susceptible to brittle fracture. Austenitic steels remain ductile at low temperatures and may be preferred for application such as blowdown lines. Brittle fracture is possible whenever low temperatures are involved, in particular low temperatures associated with gas expansion. This is particularly the case when systems are still pressurised, although in some circumstances, the differential stresses through the wall of a vessel by sudden cooling could lead to crack propagation. Issues for Safety Case Assessment Choice of materials. Identification of vulnerable components. 4.4.3 Ageing/Mechanical Degradation [5.1.G20]
The effect of ageing is undoubtedly one of the major integrity issues facing the older installations. Ageing encompasses degradation mechanisms such as fatigue and corrosion. There are also some other phenomena, for example creep and the deterioration in mechanical properties such as fracture toughness. The latter phenomenon is associated with changes in transition temperatures. Provision against these mechanisms is explicitly required, as part of the design criteria and operational monitoring exists for the express purpose of detecting these phenomena. Nevertheless, ageing related failures are occurring. The implication of this is that either plant is being operated beyond its original design life, that conditions have changed because modification has rendered the initial assumptions invalid or that inspection regimes are inadequate. In recent years, the popularity of risk-based inspection schemes has led to situations where inspection intervals have been lengthened for some plant. Where such decisions have been made, the requirements on the knowledge about plant state are high. Issues for Safety Case Assessment As for fatigue, corrosion and other degradation phenomena above; including: Whether initial design assumptions are still valid. Whether modifications have had their implications on lifetime assessed. Whether the inspection regime is adequate.
90
4.5
Dropped Loads [5.1.G17]
Major hazards assessed are the impact of dropped loads onto hydrocarbon containment plant and or accommodation areas. Protection essentially relies upon having an effective safety management system. Typical benchmarks employed include: HSG221 Technical guidance on the safe use of lifting equipment offshore BS 7121-2 & 11 Code of practice for the safe use of cranes Step Change lifting and mechanical handling guidelines OMHEC Training Standard for offshore crane operators and banksmen OMHEC Enterprise of competence
91
Issues for Safety Case Assessment Plans showing crane over sail area and identification of areas where HC piping and vessels and accommodation units are vulnerable to dropped loads and or boom collapse. References to dropped object/load impact studies and their conclusions. Provision of protective barriers on vulnerable areas. Description of cranes and lifting machinery including safe working load, de-rating for prevailing sea state, and rated capacity indicator. Details of the arrangements for maintenance and thorough examination of cranes. Details of how competence is assessed for crane operators, banskmen, slingers and for those responsible for planning lifting operations. Evidence that lifting operations are planned and assistance is available to identify and plan non-routine lifts. 5. Other Related Assessment Sheets in this Section are: 5.1.G1 Part 1 5.1.G1 Part 2 5.1.G2 5.1.G18 5.1.F16 6. Corrosion: Internal Corrosion: External Erosion Seismic Event High Integrity Protection Systems [HIPS]
Cross-Referenced Sections and Sheets are: Section 5.2 Loss of Containment - Pipelines
7.
8.
92
5.1.HS2:
1.
Heat Exchangers
Confirmation should be obtained that heat exchangers have been designed, constructed in accordance with recognised standards or codes of practice. Recognised standards/codes of practice would include: BS EN ISO 16812:2003 and API Standard 660 for shell & tube exchangers BS EN ISO 15547:2001 and API Std 662 for plate heat exchangers BS EN ISO 13706:2000 and API Std 661 for air cooled heat exchangers BS EN ISO 13705:2002 and API Std 560 for fired heaters TEMA Standards of the Tubular Exchanger Manufacturers Association are applicable for tubular heat exchangers. Pressure Vessel Design Codes applicable to heat exchangers: PD 5500:2003 Specification for unfired fusion welded pressure vessels BS EN 13445 Unfired pressure vessels ASME VIII Boiler and pressure vessel code Printed circuit heat exchangers [PCHEs] are normally designed to ASME VIII Division 1 but other design codes such as PD 5500 can be employed as required by the purchaser.
2.
Where a standard/code of practice other than those listed above has been employed, judgement as to the adequacy of the heat exchange equipment can only be assessed on an individual basis and the duty holder should be required to justify that the applied standard/code will be equally effective. Relevant Legislation, ACOP and Guidance includes: Offshore Installations (Safety Case) Regulations 2005, Regulation 12(1)(c) Assessment Principles for Offshore Safety Cases [APOSC] paras 14 and 35 Provision and Use of Work Equipment Regulations 1998 Regulation 4
3.
4.
Specific Technical Issues: 4.1 Shell and Tube Heat Exchangers
Flow induced tube vibration which results in thinning of the tubes can occur where the tubes pass through the tube sheets. The possibility of this occurring should have been examined as part of the design. The provision of overpressure relief for tube failure should be considered when the design pressure for the low pressure side of the exchanger is less than 2/3 of the design pressure of the high pressure side. Justification should be provided if the requirements of the 2/3 rule [as contained in API RP 521] are not met. [NB the 2/3 rule is written in the context of ASME pressure vessel codes for which the test pressure is typically 150% of the design pressure. In the rare circumstances where test pressures do not conform to these requirements, the 2/3 rule may not apply and more detailed assessment will be necessary.] Related guidance: API RP 52 Guide for Pressure Relieving and Depressuring Systems. 4th Edition March 1997
93
IP Guidelines for the Design and Safe Operation of Shell and Tube Heat Exchangers to Withstand the Impact of Tube Failure, August 2000, ISBN 0 85293 286 3 4.2 Printed Circuit Heat Exchangers
For PHCEs there is an issue with thermal cycling which has been known to have caused failure of the integrity of the heat exchange matrix. This phenomenon is most likely to occur when the unit is subjected to frequent start-ups and shutdowns. Confirmation should be sought that this has been taken into account as part of the design process. 4.3 Gasketed Plate Heat Exchangers
There is a likelihood of significant hydrocarbon release to the atmosphere on gasket failure. Shields should normally be fitted to prevent fluids from contacting personnel in the event of gasket failure. There is a working pressure limitation for gasketed plate heat exchanger of approx 25 barg. 5. Other Related Assessment Sheets in this Section are: 5.1.HS1 6. Pressure Vessels (Including Columns)
7.
8.
94
5.1.HS3:
1.
Atmospheric Vessels [eg Wemcos, TPSs]
Confirmation should be obtained that atmospheric vessels and their accessories have been designed and constructed in accordance with recognised standards or codes of practice. Recognised standards/codes of practice would include: API Standard 2000 Venting Atmospheric and Low Pressure Storage Tanks; Non Refrigerated and Refrigerated, 5th Edition, 1998 API Publication 2210 Flame Arresters for Vents of Tanks Storing Petroleum Products API Bulletin 2521 Use of Pressure-Vacuum Vent Valves for Atmospheric Pressure Tanks to Reduce Evaporation Loss API Standard 620 Design and Construction of Large, Welded, Low Pressure Storage Tanks API Standard 650 Welded Steel Tanks for Oil Storage API Specification 12D Field Welded Tanks for Storage Production Liquids API Specification 12F Shop Welded Tanks for Storage of Production Liquids BSI 1564:1975 Specification for the manufacture of vertical steel welded non-refrigerated storage tanks with butt-welded shells for the petroleum industry
2.
Where a standard/code of practice other than those listed above has been employed, judgement as to the adequacy of the atmospheric vessel can only be assessed on an individual basis and the duty holder should be required to justify that the applied standard/code will be equally effective. Relevant Legislation, ACOP and Guidance includes: Offshore Installations (Safety Case) Regulations 2005, Regulation 12(1)(c) Assessment Principles for Offshore Safety Cases [APOSC] paras 14, 16 and 35 Provision and Use of Work Equipment Regulations 1998, Regulation 4
3.
4.
Specific Technical Issues: 4.1 Venting for Fire Exposure
It is likely that tanks installed on offshore installations will not be fitted with a frangible roofto-shell attachment for fire venting purposes. Where this is the case, confirmation should be sought that venting capacity is adequate for fire exposure conditions. 4.2 Bunding
It should be clear that any decision as to whether tanks should be bunded or not has been made in the light of a corresponding fire analysis. 4.3 The emergency dumping/draining of the flammable content of large tanks should have been considered. 4.4 Consideration should have been given to minimising storage tank sizes and inventories as part of a wider consideration of an inherently safer design features. 4.5 Methanol Storage Tanks
95
Provision should be made to limit the discharge of methanol vapour to atmosphere. For large storage tanks, the provision of an inert gas blanket should have been considered. 5. Other Related Assessment Sheets in this Section are: 5.1.F14 6. Inherent Safety
7.
8.
96
5.1.HS4:
1.
Centrifuges/Hydrocyclones
Confirmation should be obtained that centrifuges and hydrocyclones have been designed, and constructed, in accordance with recognised standards or codes of practice. Recognised standards/codes of practice would include: PD 5500:2003 Specification for unfired fusion welded pressure vessels BS EN 13445 Unfired pressure vessels ASME VIII Boiler and pressure vessel code
2.
Where a standard/code of practice other than those listed above has been employed, judgement as to the adequacy of the centrifuge or hydrocyclone can only be assessed on an individual basis and the duty holder should be required to justify that the applied standard/code will be equally effective. Relevant Legislation, ACOP and Guidance includes: Offshore Installations (Safety Case) Regulations 2005, Regulation 12(1)(c) Assessment Principles for Offshore Safety Cases [APOSC] paras 14 and 35 Provision and Use of Work Equipment Regulations 1998, Regulation 4
3.
4.
5.
Other Related Assessment Sheets in this Section are: 5.1.HS1 Pressure Vessels (Including Columns)
6.
7.
8.
97
5.1.HS6:
1.
Smallbore Tubing
Confirmation should be obtained that the design, installation and maintenance of smallbore tubing is in accordance with recognised standards or codes of practice. Recognised standards/codes of practice would include: Guidelines for the Management, Design, Installation and Maintenance of Smallbore Tubing Systems: UKOOA/Institute of Petroleum 2000
2.
Where a standard/code of practice other than that listed above has been employed, judgement as to the adequacy can only be made on an individual basis and the duty holder should be required to justify why equivalent standards of safety should result. Relevant Legislation, ACOP and Guidance includes: Offshore Installations (Safety Case) Regulations 2005, Regulation 12(1)(c) Assessment Principles for Offshore Safety Cases [APOSC] paras 14 and 35 Provision and Use of Work Equipment Regulations 1998, Regulation 4
3.
4.
Specific Technical Issues: None over and above those described in the referenced standard.
5.
Other Related Assessment Sheets in this Section are: 5.1.G6 Fatigue/Vibration Cracking
6.
7.
8.
98
5.1.HS8:
1.
Flexible Hoses
Confirmation should be sought that the design, specification and usage of flexible hoses used on the installation is in accordance with a recognised standard or code of practice. Recognised standards/codes of practice include: Flexible Hose Management Guidelines: UKOOA/HSE/Institute of Petroleum 2003
2.
Where a standard/code of practice other than that listed above has been employed, judgement as to the adequacy can only be made on an individual basis and the duty holder should be required to justify why equivalent standards of safety should result. Relevant Legislation, ACOP and Guidance includes: Offshore Installations (Safety Case) Regulations 2005, Regulation 12(1)(c) Assessment Principles for Offshore Safety Cases [APOSC] paras 14 and 35
3.
4.
5.
6.
Cross-referenced Sections and Sheets are: None
7.
8.
99
5.1.HS9: 5.1.HS10: 5.1.HS11:
Pumps Compressors Turbines
[Relevant Sheets: 5.1.G7, 5.1.G19] 1. Introduction This sheet is to provide guidance for safety case assessment for areas dealt with by the Mechanical Systems Team OSD3.4. What follows is therefore generally applicable to the mechanical integrity of machinery and rotating equipment. Aspects specific to hydrocarbon containment are dealt with elsewhere. Similarly, process control and plant isolation requirements are not dealt with here. The document is not intended to limit the scope of an assessor to pursue any aspect of safety that they believe is important to a particular safety case, within the remit provided by the Safety Case Regulations. It is though intended to provide guidance as to the minimum acceptable demonstration of safety that a duty holder should be able to provide. As with all safety case assessment work, there is a need for HSE assessors to concentrate on areas where there are grounds for believing the safety demonstration may be weakest. Knowledge of such areas comes from HSEs collective experience, as well as that of the wider engineering community. There is some guidance below that provides pointers towards what are believed to be the most pressing concerns. Conversely, it is not considered necessary or practical for a particular safety case to mention explicitly all of the aspects of design and operational concerns identified below. However, the duty holder should in principle be able to address all such concerns and hence provide an adequate demonstration of integrity. Therefore, in the last resort, it is reasonable for an assessor to question a duty holder on any aspect of the integrity justification. 2. Machinery and Rotating Equipment Integrity Machinery and rotating equipment is often packaged together to form a single system. The packages employ a combination of rotating equipment such as pumps, compressors and generators, driven by a gas turbine or electric motor. Typical applications include:
Process and export gas compression Oil export pumping Fire water pumping Utilities [electricity generation/compressed air]
Our main source of reference is HSEs Inspection Guidance Notes [IGN]: HSE Research report 076 Machinery and Rotating Equipment Integrity Inspection Guidance Notes. The IGN provides technical guidance that focuses on commonly used equipment such as gas compression and oil export packages, typical machinery including turbines, motors and diesel engines, and rotating equipment such as pumps and compressors etc. The IGN provides an understanding of the technology used and considers those aspects of design, operation and maintenance that could contribute to a major offshore incident. The report also includes a structured review to assist Inspectors gauge compliance with statutory requirements and it gives examples of poor practice to look out for. A comprehensive list of relevant standards is provided in Section 5.15 of the IGN.
100
3.
Relevant Legislation, ACOP and Guidance Includes: Offshore Installations (Safety Case) Regulations 2005, Regulation 12(1)(c) Assessment Principles for Offshore Safety Cases [APOSC] paras 14 and 35
4.
5.
6.
7.
8.
101
5.1.HS13:
1.
Deck Tanks
Confirmation should be obtained that deck tanks and their accessories have been designed and constructed in accordance with recognised standards or codes of practice. Recognised standards/codes of practice include: API Standard 2000 Venting Atmospheric and Low Pressure Storage Tanks; Non Refrigerated and Refrigerated, 5th Edition, April 1998 API Publication 2210 Flame Arresters for Vents of Tanks Storing Petroleum Products API Bulletin 2521 Use of Pressure-Vacuum Vent Valves for Atmospheric Pressure Tanks to Reduce Evaporation Loss API Standard 650 Welded Steel Tanks for Oil Storage API Specification 12D Field Welded Tanks for Storage of Production Liquids API Specification 12F Shop Welded Tanks for Storage of Production Liquids BS 1564:1975 Specification for the manufacture of vertical steel welded non-refrigerated storage tanks with butt-welded shells for the petroleum industry BS 1564:1975 Specification for pressed steel sectional rectangular tanks.
2.
Where a standard/code of practice other than that listed above has been employed, judgement as to the adequacy of the deck tank can only be assessed on an individual basis and the duty holder should be required to justify that the applied standard/code will be equally effective. Relevant Legislation, ACOP and Guidance includes: Offshore Installations (Safety Case) Regulations 2005, Regulations 12(1)(c) Assessment Principles for Offshore Safety Cases [APOSC] paras 14 and 35 Provision and use of Work Equipment Regulations 1998, Regulation 4
3.
4.
Specific Technical Issues: 4.1 Venting for Fire Exposure
Venting capacity should be adequate for fire exposure. 4.2 Methanol Storage Tanks
Provision should be made to limit the discharge of methanol vapour to atmosphere. 5. Other Related Assessment Sheets in this Section are: None 6. Cross-Referenced Sections and Sheets are: None 7. Lead Assessment Section for this Sheet: OSD3.1 8. Team responsible for authoring and updating this sheet: OSD3.1
102
5.1.HS15:
1.
Hazardous Drains/Caisson
Confirmation should be obtained that the hazardous drains system and disposal caisson have been designed and constructed in accordance with recognised standards or codes of practice. Recognised standards/codes of practice include: Pipework: ANSI B31.3 Petroleum refinery piping Sump Tanks & Disposal Caisson: API Standard 2000 Venting Atmospheric and Low Pressure Storage Tanks; Non Refrigerated and Refrigerated, 5th Edition, April 1998
2.
Where a standard/code of practice other than that listed above has been employed, judgement as to the adequacy of the hazardous drains system and disposal caisson can only be assessed on an individual basis and the duty holder should be required to justify that the applied standard/code will be equally effective. Relevant Legislation, ACOP and Guidance includes: Offshore Installations (Safety Case) Regulations 2005, Regulation 12(1)(c) Assessment Principles for Offshore Safety Cases [APOSC] paras 14 and 35
3.
4.
Specific Technical Issues: 4.1 Flame Arrester
The hazardous drains sump tanks and disposal caisson will generally be vented to the atmospheric vent header although, in some cases, a dedicated vent may be provided. In either case, the vent should be fitted with a flame arrestor designed to API 2210 or equivalent. 4.2 Wave Action
The drains sump vent should be of sufficient capacity to accommodate the inbreathing and outbreathing due to the rise and fall in liquid level as a result of wave action. Dip pipes, within the caisson, should terminate at sufficient depth to ensure that they are submerged at all times. 4.3 Dip Pipe Perforation
Dip pipes can be subjected to accelerated rates of corrosion at, or just below, the liquid level in the caisson. Perforation resulting from such corrosion may result in the migration of hydrocarbon vapour from the caisson into the drains system, [this has resulted in a number of hydrocarbon releases]. Confirmation should be obtained that there is an inspection scheme in place to address this phenomenon. 4.4 A number of hydrocarbon releases have resulted from poor design involving inappropriate interconnections between the closed/flare system and the open drains. Plant blowdown then causes gas to discharge from the open drains. Confirmation should be sought that this possibility has been examined during the plant HAZOP studies. 5. Other Related Assessment Sheets in this Section are: None
103
6.
7.
8.
104
5.1.HS17:
1.
Flare Towers
Confirmation should be obtained that flare towers have been designed and constructed in accordance with recognised standards or code of practice. Recognised standards/codes of practice include: API RP 521 American Petroleum Institute [1997] Guide for Pressure Relieving and Depressurising Systems The Institute of Petroleum [2001] Guidelines for the Safe and Optimum Design of Hydrocarbon Pressure Relief and Blowdown Systems ISBN 0 85293 287 1 The above codes, standards and guidance are applicable to flare towers on both fixed installations and FPSOs. Well test equipment on drilling installations is likely to have dedicated well test flare booms.
2.
Where a standard/code of practice other than that listed above has been employed, judgement as to the adequacy of the flare tower can only be assessed on an individual basis, and the duty holder should be required to justify why its procedures/practices in the relevant areas will deliver an equivalent level of health and safety performance. Relevant Legislation, ACOP and Guidance includes: Offshore Installations (Safety Case) Regulations 2005, Regulation 12(1)(c) Assessment Principles for Offshore Safety Cases [APOSC] paras 14 and 35
3.
4.
Specific Technical Issues: A review of lessons learned from past incidents is given in Section 6 of Institute of Petroleum Guidelines for the Safe and Optimum Design of Hydrocarbon Pressure Relief and Blowdown Systems. This guide includes checklists for assessment of relief and blowdown systems [pp 100-102] for both designers and operators. The guide should be included as part of the assessment process. An overview of radiation exposure levels is given in Section 5.8 of the Institute of Petroleum Guidelines for the Safe and Optimum Design of Hydrocarbon Pressure Relief and Blowdown Systems. Confirmation should be obtained that the suggested limits are not exceeded.
5.
Other Related Assessment Sheets in this Section are: 5.1.F15 Relief Systems
6.
7.
8.
105
5.1.HS18:
Mechanical Integrity of FPSO Mooring Turrets
[Relevant Sheets: 5.1.G.9] Introduction Many floating production storage and offtake facilities [FPSOs] employ the principal of free weathervaning of the hull round a geostationary mooring spread. For this purpose, the hull structure is designed or modified to accommodate an internal turret to which static mooring lines are fixed permitting unrestricted rotation of the vessel about that axis of fixation. The turret incorporates a bearing arrangement similar to a crane slew ring to reduce friction and, also usually a high pressure swivel system to permit and control the transfer of fluids from the stationary risers to the rotating vessel and its processing and storage facilities. The design and operational safety/integrity of the bearing and swivel arrangements are matters for technical assessment by OSD Mechanical Specialists at the design safety case and operational safety case stages. Other aspects such as integration of the turret with the hull structure and the design/integrity of flowlines and flexible risers need to be addressed by respective specialist sections. Assessment Principles i. There are no national or international standards or formal codes for the design of turrets or swivels, although they draw heavily upon existing large low speed bearing design and fluid/gas sealing technology. Each example to date is a bespoke engineering solution and the most appropriate method of assessment therefore involves the basic principals of hazard identification, FMEA, Risk Assessment and whether risks are controlled to ensure compliance with the relevant statutory provisions. OSD3.4, to obtain the information necessary to approach the assessment task in a competent and consistent manner, commissioned a technical survey of published information covering all FPSO and FSO installations in the UK sector. From this information a practical and comprehensive database was created called:
ii.
The FPSO Turret and Swivel Interactive Knowledge Base The IKB provides the following principal reference facilities: i. General description of turret systems Ship structures General systems and arrangements Mooring systems and turret loadings
ii.
Scaffolding and support systems Personnel Construction standards Turret system design Major components and boundaries Turret transfer systems
106
iii. iv. v. vi.
Interfacing systems
Fluid transfer systems Failure modes Inspection and maintenance Examples of good and bad practice
This extensive register encompasses detail of all existing turret mooring designs and arrangements existing in UK waters. In addition it discusses in appropriate technical language the merits and weaknesses of respective systems and guides the reader first toward an appreciation of the broader aspects of the technology, hazard identification and risk recognition processes, to a position where specific examples may be subject to comparative appraisal against a cross industry selection of design types and their operational characteristics and histories. 3. Relevant Legislation, ACOP and Guidance includes: Offshore Installations (Safety Case) Regulations 2005, Regulation 12 Offshore Installations (Prevention of Fire and Explosion, and Emergency Response) Regulations 1995, Regulations 4, 5, 9 & 19 Offshore Installations and Wells (Design and Construction, etc) Regulations 1996, Regulations 4, 5, 6, 7 & 8 4. For marginal field development the turret moored FPSO offers commercial attractions. Mooring turrets clearly embody major hazard potentials including both the control of the transient hazardous inventories within them and station keeping of the parent vessel. Full and intelligent use of the FPSO turret database and application of its reflective appraisal procedures are the best means available for assessing and evaluating both the design and the lifetime operational integrity of this advanced production technology. Other Related Assessment Sheets in this Section are: For the purpose of this manual mooring turrets have been assigned to Section 5.1 - Loss of Containment - Process. However, the turret is a multi functional design feature, its construction and housing form an integral part of the vessel primary structure and the mooring system. Whilst these considerations are the responsibility of structural and marine specialists, structural strength and especially stiffness are of paramount importance to the performance of the turret bearings, seals and flanged joints. Consequently there are at least three safety critical elements to be assessed in relation to the turret, namely integrity of primary and support structure, mooring integrity and the integrity of fluid paths [flexible risers, swivels and rigid pipework]. It is therefore desirable that the assessment of turret design and operational issues should be undertaken on a multi discipline basis with input from OSD5 and other OSD3 Specialist Teams. 6. Cross-Referenced Sections and Sheets are: None 7. Lead Assessment Section for this Sheet: OSD3.4 8. Team responsible for authoring and updating this sheet: OSD3.4
5.
107
5.1.HS19:
1.
Temporary Equipment
Confirmation should be obtained that systems and procedures are in place to manage the risks associated with the use of temporary equipment. These should be broadly in line with the guidance given in SPC/TECH/OSD/25. Confirmation should also be obtained that all temporary equipment has been designed and constructed in accordance with recognised standards or codes of practice, or if not, justification sought as to why the standard(s) employed should result in equivalent levels of safety.
2.
Where systems and procedures differ markedly from those recommended in SLC 2004/02, judgement as to the adequacy of the management of risks associated with the temporary equipment can only be assessed on an individual basis and the duty holder should be required to justify that the applied systems and procedures will be equally effective. Relevant Legislation, ACOP and Guidance includes: Offshore Installations (Safety Case) Regulations 2005, Regulation 12(1)(c) Assessment Principles for Offshore Safety Cases [APOSC], paras 14 and 35 Provision and Use of Work Equipment Regulations 1998, Regulation 4
3.
4.
Specific Technical Issues: 4.1 Deciding What Is, and Is Not, Temporary Equipment
Essentially Temporary Equipment compromises equipment which is not a permanent part of the installation, and which is intended to be removed after a finite period of time. 4.2 Impact of Temporary Equipment on Existing Plant/Systems
A HAZID and HAZOP should have been conducted to ensure that the Temporary Equipment will not compromise the integrity of the existing plant and systems [and vice versa]. 4.3 Control of Change
There should be systems/procedures in place to control short term amendments to existing procedures/documentation. The systems/procedures should cover the reinstatement of amended material. 4.4 Competence and Training
Temporary training requirements need to be identified, recorded and implemented. Contractor competence and training should be verified by the duty holder. 4.5 Control of Contractors
The integration of systems/procedures will be required where the Contractors have their own systems/procedures for the operation, control and maintenance of the temporary equipment. 5. Other Related Assessment Sheets in this Section are: None 6. Cross-Referenced Sections and Sheets are: None
108
7.
8.
109
5.1.G1 Part 1: Corrosion: Internal

Topsides Plant 1. Confirmation should be obtained that internal corrosion is being managed through implementation of a corrosion management system. There are no recognised standards or codes of practice that deal with the corrosion management system. Hence in cooperation with the offshore industry CAPCIS have prepared the research report OTO 2001/044 Review of Corrosion Management for Offshore Oil and Gas Processing for HSE, which provides guidance and examples of best practice. This is considered to be the benchmark that duty holders corrosion management system should satisfy. Recognised standards and codes of practice dealing with certain specific elements of corrosion management include: DnV RP G-101 Risk Based Inspection of Topsides Static Mechanical Equipment API Publication 581 Risk Based Inspection HSE RR363/2001 Best Practice for risk based inspection as part of integrity management RIMAP Generic Risk Based Inspection and Maintenance Planning NORSOK standard M-506 CO2 Corrosion Rate Calculation Model NORSOK Standard M-CR-505 Corrosion Monitoring Design NACE Standard RP0775 Preparation and Installation of Corrosion Coupons and Interpretation of Test Data in Oil Field Operations NACE Standard RP0497 Field Corrosion Evaluation Using Metallic Test Specimens NACE Standard RP0192 Monitoring Corrosion In Oil & Gas Production with Iron Counts ASTM G4 Standard Guide for Conducting Corrosion Coupon Tests in Field Application ASTM G96 Standard Guide for On-line Monitoring of Corrosion in Plant Equipment [Electrical and Electrochemical Methods] Institute of Petroleum Model Code of Safe Practice for Petroleum Industry Part 13: Pressure Piping Systems Examination Institute of Petroleum Model Code of Safe Practice for Petroleum Industry Part 12: Pressure Vessel Systems Examination EEMUA 193 Recommendations for the Training, Development and Competency Assessment of Inspection Personnel EEMUA 179 A Working Guide for Carbon Steel Equipment in Wet H2S Service [Developed largely from Oil Refinery experience] API RP574 Inspection Practices for Piping System Codes API RP570 Piping Inspection Code: Inspection, repair, alteration and re-rating of inservice piping systems API RP510 Pressure vessel inspection code: Maintenance inspection, rating, repair, and alteration 2. Where a standard/code of practice other than those listed above has been employed, judgement as to the adequacy of corrosion management can only be assessed on an individual basis, and the duty holder should be required to justify why its
110
procedures/practices in the relevant areas will deliver an equivalent level of health and safety performance. 3. Relevant Legislation, ACOP and Guidance includes: Offshore Installations (Safety Case) Regulations 2005, Regulations12(1)(c) and 12(1)(d) Assessment Principles for Offshore Safety Cases [APOSC], paras 95, 98 and 102 Offshore Installations (Prevention of Fire and Explosion, and Emergency Response) Regulations 1995, Regulations 4(1)(a); 9(b) and 12 Pressure Equipment Regulations 1999 4. Specific Technical Issues: The safety case assessment should seek to establish to what extent aspects of the corrosion management system listed below have been addressed particularly because experience has shown them to be contributory factors in corrosion incidents:
Clear, explicit policy governing corrosion and plant monitoring. Sufficient inhouse expertise, clear allocation of responsibilities and involvement of offshore staff to enable delivery of the policy. Better analysis and integration of inspection and monitoring data including use of statistical techniques to allow for uncertainties resulting from limitations of inspection techniques and coverage. Better use of opportunistic inspection. Better documentation of system. Increased utilisation of platform staff knowledge and raised awareness. Widen scope of inspection plans that includes certain amount of speculative inspection. Improved identification of corrosion hot spots based on plant walkabout rather then examination of drawings. Increased system performance monitoring and improved failure investigations that identify underlying system failures. Regular system reviews that includes assessment of system performance against set criteria, evaluation of system failures and identification of areas to be improved. Regular independent audits of the corrosion management system. Ensuring high availability of inhibitor injection system. Consideration of enhanced degradation near injection points due to local flow/environmental conditions. Planning of non-invasive inspection [NII] scheme based on considerations outlined in JIP reports HOIS NII Decision Guidance, Mitsui Babcock GSP 235, Recommended Practice for NII. Minimisation of deadlegs and where unavoidable implementation of targeted inspection scheme.
111
Identification of areas prone to pitting and application of the most appropriate inspection techniques and prevention schemes including designing them out. Identification of components that could suffer preferential weld corrosion and application of appropriate specialised inspection techniques and prevention strategies. Further guidance in JIP report Risk of preferential weldment corrosion of ferritic steels in CO2 containing environments and the Guidelines for the prevention, control and monitoring of preferential weld corrosion of ferritic steels in wet hydrocarbon production systems containing CO2. Level of attention given to the hydrocarbon drains systems integrity management. Special consideration of the failure mechanisms of smallbore piping [3 and below] and application of appropriate inspection techniques. Consideration of chloride stress corrosion cracking and or pitting in corrosion resistant materials operating in environmental condition where high concentration of salts can develop. Management of process conditions [ie ensuring no oxygen] to prevent formation and deposition of elemental sulphur in plant handling sour fluids. More user friendly and accessible corrosion monitoring probe and chemical injection quill access fittings and locations. Inspection and monitoring data analysis including use of statistical and reliability methods. How is past experience captured and incorporated in the design of corrosion protection measures for new installations.

5.
Other Related Assessment Sheets in this Section are: 5.1.G2 5.1.G6 5.1.G15 5.1.G20 5.1.G24 5.1.G25 Erosion Fatigue/Vibration Cracking Deficient Procedures: Maintenance Ageing/Mechanical Degradation Incorrect Material Specification Incorrect Material Usage
6.
7.
8.
112
5.1.G1 Part 2: Corrosion: External

Topsides Plant and Structure 1. Confirmation should be obtained that external corrosion has been managed by implementation of a corrosion management system. There is no single national or international standard dealing with this topic and hence a number of approaches, including treating it as part of the process plant corrosion management system or the installation fabric maintenance system have been adopted. Recognised standards/codes of practice dealing with certain specific elements of corrosion management include: OT0 2001-011Corrosion Protection BS5493 Code of practice for protection of iron and steel structures against corrosion NORSOK standard M-501 Surface preparation and protective coatings ISO 12944 Paints and Varnishes Corrosion Protection of Steel Structures 85 5493: 1977 Protective coating of iron and steel structures against corrosion. EN ISO 14713: Protection against corrosion of iron and steel in structures - Metal coatings - Guide. EN ISO 1461: Hot dip galvanized coatings on fabricated products. EN 10240: (Draft) Coatings for steel tubes: Specification for hot dip galvanized coatings. ISO 4628-3: 1982 Paints and varnishes - Evaluation of degradation of paint coatings Designation of intensity, quantity and size of common types of defect - Part 3: Designation of degree of rusting. BS 7079: Part Al Preparation of steel substrates before application of paints and related products - Visual assessment of surface cleanliness - Part 1: Rust grades and preparation grades of uncoated steel substrates and of steel substrates after overall removal of previous coatings. ISO 9223: 1992 Corrosion of metals and alloys - Corrosivity of atmospheres Classification. ISO 11303:2002 Corrosion of metals and alloys - Guidelines for selection of protection methods against atmospheric corrosion EN 22063: 1993 Metallic and Other Inorganic Coatings - Thermal Spraying - Zinc, Aluminium and Their Alloys EEMUA 200 Guide to the specification, installation, maintenance of spring supports of piping ISO CD 19902 Petroleum and natural gas industries Fixed offshore structures 2. Where a standard/code of practice other than those listed above has been employed, judgement as to the adequacy of corrosion management system can only be assessed on an individual basis, and the duty holder should be required to justify why its procedures/practices in the relevant areas will deliver an equivalent level of health and safety performance. Relevant Legislation, ACOP and Guidance includes: Offshore Installations (Safety Case) Regulations 2005, Regulations 12(1)(c) and 12(1)(d
3.
113
Assessment Principles for Offshore Safety Cases [APOSC] paras 95, 98 and 102 Offshore Installations (Prevention of Fire and Explosion, and Emergency Response) Regulations 1995, Regulations 4(1)(a), 9(b) & 12 Pressure Equipment Regulations 1999 4. Specific Technical Issues: External corrosion of topsides on an ageing installation does not usually receive the same degree of attention as the management of the internal corrosion with the result that on a number of installations the primary threat of hydrocarbon release is from external corrosion. In addition a significant number of personnel injuries on such installations are due to falls and trips resulting from failure of corroded members used as temporary supports or steps. Corroded walkways have also featured in a number of incidents. Particular issues that should be probed as part of the safety case assessment include:
Management of process plant integrity around corrosion traps such as pipe supports, penetrations, saddles, etc. Management of the risks associated with surface preparation and painting on live plant. Management of corrosion under insulation. Management of bolt corrosion. Management of pitting and stress corrosion cracking in corrosion resistant alloy piping and tubing operating in areas exposed to sea spray/deluge. See RR129 Review of external Stress Corrosion Cracking of 22% Cr Duplex Stainless Steel for further guidance. Painting and refurbishment planning systems and performance standards including short term remedies. Maintenance of spring supports. Corrosion management of walkways, hand railings, escape equipment attachment points and other similar secondary structural components.

5.
Other Related Assessment Sheets in this Section are: 5.1.G15 5.1.G20 5.1.G24 5.1.G25 Deficient Procedures: Maintenance Ageing/Mechanical Degradation Incorrect Material Specification Incorrect Material Usage
6.
7.
Lead Assessment Section for this Sheet: OSD5.1 for process plant and OSD5.1 OSD5.4 for topsides structures.
8.
114
5.1.G2:
1.
Erosion
Confirmation should be obtained that erosion is being managed through implementation of an erosion management system that includes amongst other things selection of appropriate materials and coatings, control of fluid velocities, removal/prevention of solid particles, effective detection systems, plant design that minimises changes in flow direction and erosion resistant valve design. Recognised standards/codes of practice dealing with erosion include: DNV Recommended Practice RP 0501 Erosive Wear in Piping Systems ISO 13703 Offshore Piping Systems API RP14E Design and Installation of Offshore Production Platform Piping Systems
2.
Where a standard/code of practice other than those listed above has been employed, judgement as to the adequacy of erosion management system can only be assessed on an individual basis, and the duty holder should be required to demonstrate its procedures/practices in the relevant areas will deliver an equivalent level of health and safety performance. Relevant Legislation, ACOP and Guidance includes: Offshore Installations (Safety Case) Regulations 2005, Regulations 12(1)(c) and 12(1)(d) Assessment Principles for Offshore Safety Cases [APOSC], paras 95, 98 and 102 Offshore Installations (Prevention of Fire and Explosion, and Emergency Response) Regulations 1995, Regulations 4(1)(a), 9(b) and 12 Pressure Equipment Regulations 1999
3.
4.
Specific Technical Issues: There have been a number of major hydrocarbon releases recently caused by solids particle erosion where failure of a number of crucial control measures had occurred. Wall thinning is usually very rapid and hence prevention rather then control should be the guiding principle. Operations staff do not always appreciate the impact of the production rate on erosion risk. Prevention of erosion in the production plant can be achieved by design whereas for well servicing and drilling operations process management is usually the only available option. Erosion tends to be a localised effect which means that a very good knowledge of the local rather then global flow velocities is required in order to assess erosion risks. Sand detection systems have proved to have varying reliability and hence their effectiveness should be explored as part of the assessment process. Relevant guidance documents include: RR115 Erosion in Elbows in Hydrocarbon Production systems: Review Document SPC/TECH/OSD/19 Offshore Produced Sand Management
5.
Other Related Assessment Sheets in this Section are: 5.1.G1 Part 1 Corrosion: Internal 5.1.G1 Part 2 Corrosion: External
6.
115
7.
8.
116
5.1.G4
1.
Internal explosion
Confirmation should be obtained that internal explosions have been assessed in accordance with a recognised standard or code of practice. Recognised standards/codes of practice would include: Fire, Explosion and Risk Assessment Topic Guidance HSE website 2003 Fire & Explosion Strategy Document HSE website 2004 OTN 95 196 1995 Gas explosion handbook HSE-OSD report Guidelines for Fire & Explosion Management (UKOOA) 1995 CMPT - A guide to QRA for Offshore Installations BS EN 13702:1999 Petroleum and Natural Gas Industries Control and Mitigation of Fires and Explosions on Offshore Production Requirements and Guidelines.
2.
Where a standard/code of practice other than those listed above has been employed, judgement as to the adequacy of the evaluation of the internal explosion hazard can only be assessed on an individual basis, and the duty holder should be required to justify why its procedures/ practices in the relevant areas will deliver an equivalent level of health and safety performance. Relevant Legislation, ACOP and Guidance include: Offshore Installations (Safety Case) Regulations 2005 Offshore Installations (Prevention of Fire and Explosion, and Emergency Response) Regulations 1995
3.
4.
Specific Technical Issues: Internal explosions are regarded as a lower risk factor in comparison to topsides external explosions. Specific attention should be paid to situations whereby air could ingress into a hydrocarbon-saturated atmosphere and form a flammable air/vapour mixture. The risk from a gas turbine sourced internal explosion should be assessed with particular emphasis on fuel/air control, emergency shutdown control and internal conditions that could give rise to volumes of un-ignited fuel air mixtures. The adequacy of Internal Explosion venting available in each engine installation should also be investigated.
5.
Other related assessment sheets in this Section are: None
6.
Cross-referenced Sections and sheets are: Section 5.1 Sheet 5.1.HS9 Sheet 5.1.HS10 Sheet 5.1.HS11 Sheet 5.1.F3 Sheet 5.1.F8 Loss of Containment - Process Pumps Compressors Turbines Installation Specific Hazard Studies Safety Integrity Levels Standards
117
Sheet 5.3.F23 7.
Fire/Smoke/Gas/Flame Detectors/Alarms
Lead assessment section for this sheet: OSD3.2
8.
Team Responsible for authoring and updating this sheet: OSD3.2
118
5.1.G7:
1.
Fire
Confirmation should be obtained that requirements for the identification of fire hazards as initiators to other hazardous events have been analysed in accordance with recognised standards or codes of practice that would be used for a manned installation. Recognised standards/ codes of practice would include: ISO/FDIS 13702 Petroleum and Natural Gas Industries Control and mitigation of fires and explosions on offshore production installations requirements and guidelines.
2.
Where a standard/code of practice other than those listed above has been employed, judgement as to the adequacy of the evaluation of these hazards can only be assessed on an individual basis, and the duty holder should be required to justify which its procedures/practices in the relevant areas will deliver an equivalent level of health and safety performance. Relevant Legislation, ACOP and Guidance includes: Offshore Installations (Safety Case) Regulations 2005 Offshore Installations (Prevention of Fire and Explosion, and Emergency Response) Regulations 1995 Fire, Explosion and Risk Assessment Topic Guidance, HSE website 2003 Fire & Explosion Strategy Document, HSE website 2004
3.
4.
Specific Technical Issues: Specific attention should be paid to the identification of mitigation barriers to stop escalation paths early in a hazardous event situation. For example, a fire detection system should be regularly tested to maintain its design performance of identifying rapidly fires in accommodation as well as process areas.
5.
6.
Cross-Referenced Sections and Sheets are: Sheet 5.3.F8 Sheet 5.3.F10 Sheet 5.3.F11 Sheet 5.3.F28 Fire Types Fire Modelling Explosion Modelling Ventilation and HVAC
7.
8.
119
5.1.G24:
1.
Incorrect Material Specification
Confirmation should be obtained that material selection has been based on a rigorous evaluation of all internal and external environments, operational and non operational conditions including upset conditions, design life and system performance standards, failure modes and consequences, inspection and monitoring requirements and health conditions. In addition to the standards listed below most process plant component standards also cover material performance requirements to some extent. Recognised standards/codes of practice dealing with materials selection include: NORSOK Standard M-001 Materials Selection EEMUA 194 Guidelines For Materials Selection and Corrosion Control for Subsea Oil and Gas Production Equipment ASME B31.3 Process Piping ASME Boiler and Pressure Vessel Code Section VIII BS5500 [PD 5500] Specification for Unfired Fusion Welded Pressure Vessels EFC Pub 16 Guidelines on Materials For Carbon and Low Alloys Steels for H2S Containing Environments in Oil and Gas Production EFC Pub 17 Corrosion Resistant Alloys for Oil and Gas Production. Guidance on General Requirements and Test Methods for H2S Service EFC Pub 23 CO2 Corrosion Control in Oil and Gas Production NACE MR0175 Sulphide Stress Cracking Resistant Materials for Oilfield Equipment NORSOK Standards M-506 CO2 Corrosion Rate Calculation Model ISO 14692 Petroleum and natural gas industries. Glass-reinforced plastics [GRP] piping
2.
Where a standard/code of practice other than those listed above has been employed, judgement as to the adequacy of materials specification can only be assessed on an individual basis, and the duty holder should be required to justify which its procedures/practices in the relevant areas will deliver an equivalent level of health and safety performance. Relevant Legislation, ACOP and Guidance includes: Offshore Installations (Safety Case) Regulations 2005, Regulations 12(1)(c), 12(1)(d) Assessment Principles for Offshore Safety Cases [APOSC], paras 95 and 98 Offshore Installations (Prevention of Fire and Explosion, and Emergency Response) Regulations 1995, Regulations 9(1) and 12 Pressure Equipment Regulations 1999
3.
4.
Specific Technical Issues: Although the above standards provide a good basis for evaluation of materials selection they are not all encompassing and hence the following should in addition be examined:
How has the industry experience been captured and fed into the materials selection process?
120

5.
What is being done to design out corrosion under lagging? Have the various problems with vessel internal coatings experienced by a number of duty holders been recognised? Are risks of preferential weld corrosion adequately addressed? How are the significant erosion risks in vessel sand wash drains tackled? Are ESD and Control valve trims adequate to maintain seal tightness under the operating environment? Are the limitations and problems in using corrosion allowance approach to manage degradation recognised? Do provisions for testing include the need to demonstrate adequacy of the materials corrosion resistance as well as physical properties? Have the limitations of 316SS tubing been considered in the material selection process? Are the particular requirements for bolting material and its corrosion protection adequately addressed?
Other Related Assessment Sheets in this Section are: Sheet 5.1.G2 Sheet 5.1.G6 Sheet 5.1.G15 Sheet 5.1.G20 Sheet 5.1.G25 Erosion Fatigue/Vibration Cracking Deficient Procedures: Maintenance Ageing/Mechanical Degradation Incorrect Material Usage
6.
7.
8.
121
5.1.G26:
1.
Thermal Radiation
Confirmation should be obtained that requirements for the identification of thermal radiation as an initiator to other hazardous events have been analysed in accordance with recognised standards or codes of practice that would be used for a manned installation. Recognised standards/codes include: ISO/FDIS 13702 Petroleum and Natural Gas Industries Control and Mitigation of fires & explosions on offshore production installations requirements and guidelines
2.
Where a standard/code of practice other than those listed above has been employed, judgement as to the adequacy of the evaluation of thermal radiation hazards can only be assessed on an individual basis, and the duty holder should be required to justify which its procedures/practices in the relevant areas will deliver an equivalent level of health and safety performance. Relevant Legislation, ACOP and Guidance includes: Offshore Installations (Safety Case) Regulations 2005 Offshore Installations (Prevention of Fire and Explosion, and Emergency Response) Regulations 1995 Fire, Explosion and Risk Assessment Topic Guidance, HSE website 2003 Fire & Explosion Strategy Document, HSE website 2004
3.
4.
Specific Technical Issues: Thermal radiation sources should be identified using techniques such as HAZOP studies in conjunction with manufacturers information, and evaluated and recorded as a thermal radiation hazard.
5.
6.
Cross-Referenced Sections and Sheets are: Sheet 5.3.F8 Sheet 5.3.F10 Sheet 5.3.F11 Sheet 5.3.F28 Fire Types Fire Modelling Explosion Modelling Ventilation and HVAC
7.
8.
122
5.1.F1:
1.
Generic Historical Data
Confirmation: in order for duty holders to estimate the frequency of potential accident scenarios, data will be required on a range of relevant inputs, ranging from failure of individual parts of the hydrocarbon containment envelope, [pressure vessels, piping, heat exchangers etc] through to the probability that alarm and preventative systems or items of equipment such as fire and gas alarms and components of the shutdown system will fail to operate correctly on demand. If the frequency estimates produced for the various accident scenarios are to be realistic and credible it is essential that the data used in deriving them is soundly based and defensible. In many cases where company or installation specific data [see 5.1.F2] is not available estimates will have to have been produced using generic historical data from across the industry worldwide. This data will have been produced using a variety of different sources. Potential sources are described in SPC/TECH/OSD/24 and include OREDA, E&P Forum, WOAD etc. Assessors should carefully examine the values assigned to the failure rates for different types of equipment against typical indicative historical values given in SPC/TECH/OSD/24. The values quoted have been produced by HSE using relevant data sources including the OSD Hydrocarbon Release Database. Where a duty holder has used a failure rate/probability which differs markedly from the indicative values given in SPC/TECH/OSD/24 and where the usage of this figure results in a significantly lower release/accident frequency being adduced, the duty holder should be requested to provide a detailed justification.
2.
3.
Relevant Legislation, ACOP and Guidance includes: Offshore Installations (Safety Case) Regulations 2005
4.
5.
Other Related Assessment Sheets in this Section are: 5.1.F2 Company and Installation Specific Data
6.
7.
8.
123
5.1.F2:
1.
Company and Installation Specific Data
Confirmation: Enquiries should be made as to whether company or installation specific data is available and has been used to estimate failure/release frequencies as opposed to reliance on generic historical data. Company/installation data is preferable to generic data as it is more likely to reflect accurately the effect of company/installation specific features such as its safety management policies/practices/ competencies, operating history etc. If it is available but has not been used, justification should be sought. Care should be taken where generic data has been employed but has been modified allegedly to reflect company specific circumstances. Experience suggests that such modifications almost invariably result in claims for lower than average failure/release rates. Clearly it is an anomalous situation where every duty holder is apparently better than average and the basis for such claims should be carefully examined. Care should also be taken in cases where company/installation data is being used but it indicates failure/release rates markedly different from the indicative figures given in SPC/TECH/OSD/24. The basis for any claims of superior performance needs to be carefully established and examined.
2.
3.
Relevant Legislation, ACOP and Guidance includes: Offshore Installations (Safety Case) Regulations 2005
4.
5.
Other Related Assessment Sheets in this Section are: 5.1.F1 Generic Historical Data
6.
7.
8.
124
5.1.F3:
1.
Installation Specific Hazard Studies
Confirmation should be obtained that installation specific hazard studies have been carried out in accordance with recognised standards or codes of practice for all operational safety cases. Normally the hazard studies should include a detailed HAZOP study. Recognised standards/codes of practice for HAZOP include: HAZOP: Guide to Best Practice I.Chem.E 2000 IEC 61882 Guide for Hazard and Operability Studies (HAZOP Studies) CIA 1977 A Guide to Hazard and Operability Studies (relevant to older installations only). The HAZOP study could be used in conjunction with other recognised techniques such as: Failure Modes and Effect Analysis (relevant standard IEC 60812 Procedures for Failure Modes and Effects Analysis). Fault Tree Analysis (relevant standard IEC 61025 Fault Tree Analysis) SAFE (Safety Analysis Function Evaluation) Charts using EN/ISO 10418 (formerly API RP 14C) methodology. BS EN ISO 17776:2002 Guidelines on tools and techniques for hazard identification and risk assessment. Restricting the hazard identification process to high level hazards [fire, explosion, toxic release, structural failure etc] can be acceptable for design safety cases (provided more detailed work is still to be carried out) but does not provide the depth or rigour required for operational safety cases.
2.
Where a standard/code of practice/methodology other than those listed above has been employed, judgement as to the adequacy of the hazard studies can only be assessed on an individual basis and the duty holder should be required to justify why the methods employed will be equally effective. Factors to note in assessing hazard studies include: i. As noted above whilst restricting the identification process to high level hazards or accidents [fire, explosion etc] may have some justification for design safety cases [where more detailed work has yet to be carried out] it is of extremely limited value in the operational safety cases context. Identifying fire as a hazard in a module containing hydrocarbon does nothing to identify ways in which the hydrocarbon might be released or where and how it might be ignited. Without this knowledge little can be done to reduce the likelihood of a fire occurring. What is required is a full examination of the ways in which the release might occur and become ignited, incorporating consideration of a full range of possible initiating events such as hardware failure, human error etc. The methodology cited above should provide an appropriate level of insight into the relevant accident scenarios, with perhaps additional amplification being provided via techniques such as Fault Tree Analysis for scenarios involving coincidental failure of multiple system components. It is also important that appropriate detailed hazard identification is applied to all activities taking place on a particular installation and not just to the more obvious process systems. For example, there have been instances where the hazard identification for such operations as drilling, workover and wirelining essentially consisted of noting that blow-out might occur with respect to the equipment, procedures and operations taking place on the individual installation under
3.
125
consideration. Maintenance related activities are another area which sometimes only receive fairly peripheral attention. ii. The possibility of accidental breakthrough of gas or liquid from a high pressure system to a lower pressure one needs to be considered as part of the hazard study process. In view of the number of accidents that have occurred in this manner, it is better if a specific HP/LP interface study has been carried out to supplement other studies such as HAZOP. It is important that such studies consider all foreseeable modes of operation. Confirmation should be sought that all actions and remedial work identified from the hazard studies have been completed and signed off.
iii. 4.
5.
Cross-Referenced Sections and Sheets are: Section 11 Section 13 Human Factors QRA
6.
7.
126
5.1.F4:
1.
Layout
Confirmation should be obtained that the layout has been designed in accordance with a recognised standard or code of practice. Recognised current standards / codes of practice would include: EN ISO 13702 (1999) Petroleum and natural gas industries Control and mitigation of fires and explosions on offshore production installations Requirements and guidelines. Particularly section 5 Installation layout EN ISO 13703 (2001) Petroleum and natural gas industries Design and installation of piping systems on offshore production platforms. Particularly Section 9.2 Layout EN ISO 15138 (2000) Petroleum and natural gas industries Offshore production installations Heating, ventilation and air-conditioning. Particularly section 5.3 System design General; 5.4 Area-specific system design; and the associated Annexes. ISO 15544 (2000) Petroleum and natural gas industries Offshore production installations Requirements and guidelines for emergency response. Particularly section 11 - Escape, refuge, evacuation and rescue and associated Annex F. Institute of Petroleum (2002) Model Code of Safe Practice Part 15 Area classification code for installations handling flammable fluids. Installation layouts may have been designed to the following superseded and obsolete codes and standards. API RP 2G (1974) Recommended Practice for Production Facilities on Offshore Structures API RP 14E (1975 - 1984) Recommended Practice for Design and installation of offshore production platform piping systems API RP 14F (1978 1985) Recommended Practice for Design and installation of electrical systems for offshore production platforms BS5345 (1976) Code of practice for the selection, installation and maintenance of electrical apparatus for use in potentially explosive atmospheres The above codes, standards and guidance are applicable to the layout of all types of installation (fixed, FPSO and MODUs).
2.
Where a standard/code of practice other than those listed above has been employed, judgement as to the adequacy of the layout can only be assessed on an individual basis, and the duty holder should be required to justify why its procedures / practices in the relevant areas will deliver an equivalent level of health and safety performance. Relevant Legislation, ACOP and Guidance includes: Equipment and Protective Systems Intended for Use in Potentially Explosive Atmospheres Regulations 1996 SI 1996/192 NB: These regulations are applicable to fixed installations but do not apply to MODUs, floating production platforms (FPPs) and floating production storage and offloading vessels (FPSOs).
3.
4.
Specific technical issues: 4.1 The safety case should not merely describe the layout but include arguments and rationale for: segregation of hazards (APOSC para 71(d)); avoidance of undue complexity (APOSC para 71(e)); location and routing of risers (APOSC para 71(g)); orientation and
127
spacing of equipment; fire zones; location of fire walls and blast walls; hazardous area classification; and, ventilation. A layout HAZOP is an appropriate technique for identifying some of these issues. 4.2 On existing installations removal of redundant equipment and removal or redesign of windwalls or module walls may reduce the potential for accumulation of flammable substances. 5. Other related assessment sheets in this Section are: 5.1.F10 6. Concept selection
Cross-referenced Sections and Sheets are: None
7.
Lead assessment section for this sheet: OSD3.1
8.
128
5.1.F8:
1.
Safety Integrity Levels Standards
Confirmation should be obtained that the consequence of failure has been identified for all instrument based protective functions. Where failure of the instrumented based protective function could lead to death or to serious injury confirmation should be obtained that the consequences of such failure have been risk assessed in accordance with a recognised standard/code of practice. Recognised standards include: UKOOA Guidelines for Instrument Based Protective Systems IEC 61508 Functional safety of electrical/electronic/programmable electronic safety related systems IEC 61511 Functional safety. Safety instrumented systems for the process industry sector Safety Integrity Levels [SILs] provide a scale for describing the performance of instrumented protection systems.
2.
Where a standard/code of practice other than those listed above has been employed, judgement as to the adequacy of the risk assessment can only be assessed on an individual basis and the duty holder should be required to justify that the methods used will be equally effective as those in the standards listed. Relevant Legislation, ACOP and Guidance Include: Management of Health and Safety at Work Regulations 1999, Regulation 3 Provision and Use of Work Equipment Regulations 1998, Regulation 18
3.
4.
Specific Technical Issues: 4.1 Where a methodology presented in the above standards has been followed but a non standard calibration/rule matrix [risk graph] has been employed the duty holder should provide a detailed justification that the non-standard/calibration rule matrix will be produce an equivalent level of safety to that which would be achieved using the standard calibrations/rules. 4.2 Although IEC 61508 permits functions with a SIL greater than SIL 3 any function allocated above SIL 3 is beyond what is recognised as acceptable practice in the UKOOA Guidelines and hence should always be queried and subject to the most detailed scrutiny. 4.3 4.4 Functions allocated a SIL 3 target should be subject to detailed assessment. Systems which should be considered for assessment include:

5.
Ballast systems Cargo handling systems Riser disconnect systems Blowout preventer systems
Other Related Assessment Sheets in this Section are: 5.1.F16 5.1.F18 5.1.F19 High Integrity Protection Systems [HIPS] Shutdown Systems Alarms and Trip Systems
129
6.
Cross-Referenced Sections and Sheets are: Section 4.1 Section 6 Loss of Maritime Integrity - Loss of Stability [Ballast systems & cargo handling systems] Wells [Blowout Preventers]
7.
8.
130
5.1.F10:
1.
Concept Selection
Confirmation should be obtained that safety issues have been given prominence in choosing between different design options and that the selection has not been dominated excessively by economic considerations. In particular, evidence should be sought that inherently safer principles as set out in the Management of Health and Safety at Work Regulations 1999, [para 27] and APOSC, [paras 67, 68 and 71] have been properly taken into account. For new manned, fixed installations this should always include consideration of providing a separate accommodation jacket removed from the drilling and production facilities. Concept selection is an issue which predominately applies at the initial design stage for a new installation where a number of different design concepts can be identified. On a more limited scale similar issues are also relevant to the design of additional facilities/modifications for an existing installation.
2.
Notwithstanding the above, whilst OSD can and should seek to influence the design toward inherently safer concepts, it has no specific legal powers in this area and the decision as to which concept is selected ultimately lies with the duty holder. OSDs role thereafter is to ensure that the risks posed by the chosen design are controlled in accordance with the requirements of the relevant statutory provisions. Relevant Legislation, ACOP and Guidance Include: Management of Health and Safety at Work Regulations 1999, ACOP para 27 Assessment Principles for Offshore Safety Cases [APOSC], paras 67, 68 and 71
3.
4.
Specific Technical Issues: Evaluation of different design concepts for a new manned, fixed installation should always include a separate bridge linked accommodation jacket as a comparator option. This option may not be reasonably practicable in all cases but there should be clear evidence that it has been carefully examined and there are sound reasons for its rejection based on ALARP principles.
5.
Other Related Assessment Sheets in this Section are: 5.1.F14 Inherent Safety
6.
7.
8.
131
5.1.F11:
1.
Size of Release, Speed of Detection and Effectiveness
Confirmation should be obtained that size of release, speed of detection and effectiveness has been assessed in accordance with a recognised standard or code of practice. Recognised standards/codes of practice would include: ISO 13702:1999 Petroleum and Natural Gas Industries Control and Mitigation of Fires and Explosions on Offshore Production Installations Requirements and Guidelines.
2.
Where a standard/code of practice other than those listed above has been employed, judgement as to the adequacy of the analysis of release, speed of detection and effectiveness can only be assessed on an individual basis, and the duty holder should be required to justify why its procedures/practices in the relevant areas will deliver an equivalent level of health and safety performance. Relevant Legislation, ACOP and Guidance Include: Offshore Installations (Safety Case) Regulations 2005 Offshore Installations (Prevention of Fire and Explosion, and Emergency Response) Regulations 1995 Fire, Explosion and Risk Assessment Topic Guidance, HSE website 2003 Fire & Explosion Strategy Document, HSE website 2004
3.
4.
Specific Technical Issues: 4.1 The release sizes used in the analysis should ideally be related to an assessment of credible failures based on a walk down of the plant/equipment in question and parts count based on as-built P&IDs. 4.2 4.3 Speed of detection and effectiveness will affect potential for escalation. Effectiveness of detection should not be based on equipment reliability alone.
5.
Other Related Assessment Sheets in this Section are: 5.1.F12 Dispersion, Open or Enclosed Modules, Ventilation Rates
6.
Cross-Referenced Sections and Sheets are: Section 5.3 Loss of Containment - Fire & Explosion
7.
8.
132
5.1.F12:
1.
Dispersion, Open or Closed Modules, Ventilation Rates
Confirmation should be obtained that ventilation regimes throughout the platform have been analysed in accordance with recognised standards or codes of practice. This includes open and closed modules, as well as open deck area. Recognised standards/codes of practice would include: BS 5925 [ISO 15138] Ventilation Principles and Designing for Natural Ventilation
2.
Where a standard/code of practice other than those listed above has been employed, judgement as to the adequacy of the installations ventilation regimes can only be assessed on an individual basis, and the duty holder should be required to justify why its procedures/practices in the relevant areas will deliver an equivalent level of health and safety performance. Relevant Legislation, ACOP and Guidance Include: Offshore Installations (Safety Case) Regulations 2005 Offshore Installations (Prevention of Fire and Explosion, and Emergency Response) Regulations 1995 Fire, Explosion and Risk Assessment Topic Guidance, HSE website 2003 Fire & Explosion Strategy Document, HSE website 2004
3.
4.
Specific Technical Issues: Local air movement surveys are recommended before any hot work or intrusive maintenance is carried out to evaluate the local ventilation rate.
5.
6.
Cross-Referenced Sections and Sheets are: Sheet 5.3.F7 Sheet 5.3.F11 Sheet 5.3.F28 Escalation, Layout Separation, Open/Closed Modules Explosion Modelling Ventilation and HVAC
7.
8.
133
5.1.F14:
1.
Inherent Safety
Confirmation should be obtained that inherent safety has been designed into the plant in accordance with a recognised standard or code of practice. Recognised standards/codes of practice would include: BS EN ISO 17776 International Standards Organisation (ISO) (2002) Petroleum and Natural Gas Industries Offshore Production Installations Guidelines on tools and techniques for hazard identification and risk assessment, L85 A Guide to the Integrity, Workplace Environment and Miscellaneous Aspects of the Offshore Installations and Wells (Design and Construction, etc) Regulations 1996, HSE Books, Regulation 5 and guidance paragraph 32. L65 Prevention of Fire and Explosion, and Emergency Response on Offshore Installations, Approved Code of Practice and guidance, HSE Books, Regulation 4 and guidance paragraph 38 and Regulation 9 and guidance paragraphs 87-88. L30 A Guide to the Offshore Installations (Safety Case) Regulations 2005, HSE Books, paragraph 23 Regulation 6 and guidance para 136 and Schedule 1 and guidance para 249. Assessment Principles for Offshore Safety Cases [APOSC], paragraphs 92-95 and 98. L21 Management of health and safety at work, HSE Books, Regulation 4, ACOP paragraph 29, guidance paragraph 30 and Schedule 1. UKOOA (1996) Guidelines for Management of Safety Critical Elements: A Joint Industry Guide. UKOOA (1996) Guidelines for Fire and Explosion Hazard Management. Particularly Section 5 on Inherent Safety and Prevention. The above codes, standards and guidance are applicable to all types of installation.
2.
Where a standard/code of practice other than those listed above has been employed, judgement as to the adequacy of inherent safety can only be assessed on an individual basis, and the duty holder should be required to justify why its procedures/practices in the relevant areas will deliver an equivalent level of health and safety performance. Similar considerations will apply where the duty holder is unable to demonstrate any systematic considerations of inherent safety principles. Relevant Legislation, ACOP and Guidance Include: Offshore Installations (Safety Case) Regulations 2005, Schedule 2, para13 Offshore Installations (Prevention of Fire and Explosion, and Emergency Response) Regulations 1995, Regulations 4 and ACoP para 38 Management of Health and Safety at Work Regulations 1999, ACoP, para 27 Assessment Principles for Offshore Safety Cases [APOSC], paras 92, 93, 94, 95 and 98 OTH 96 521 Improving Inherent Safety
3.
4.
Specific Technical Issues: 4.1. During the design stage, which covers concept selection through to detailed design specification [drawings, calculations, specifications, etc], there is the maximum potential for reducing risks, by early application of the principles of inherently safer design.
134
For example consideration should have been given to avoiding offshore processing [process onshore], inventory minimisation, segregation, complexity reduction, provision of separate accommodation, etc. See SPC/ENFORCEMENT/35 Safety in Design. 4.2. An installation that is designed and constructed such that risks are controlled to ensure compliance with the relevant statutory requirements depends to a significant extent on the efforts applied to achieve inherently safer design at the earliest stages of the project design process. See SPC/ENFORCEMENT/14 Design Management. 4.3 Incorporating the principles of inherent safety implies that installations should preferably be designed to have fully rated risers, vessels, pipework and pipelines. If the topsides are not fully rated a hierarchy of over-pressure protection measures should have been considered: full flow relief; partial relief with instrumented protection system; HIPS, etc. 5. Other Related Assessment Sheets in this Section are: 5.1.F4 5.1F10 5.1.F16 6. Layout Concept Selection High Integrity Protection Systems [HIPS]
7.
8.
135
5.1.F15:
1.
Relief Systems
Confirmation should be obtained that relief systems have been designed and constructed in accordance with a recognised standard or code of practice. Records standards/codes of practice would include: API RP 520 Part II American Petroleum Institute, Sizing, Selection and Installation of Pressure - Relieving Devices in Refineries, Part I Sizing and Selection, API RP 520 Part I (2000); Part II Installation API RP 521 American Petroleum Institute (1997) Guide for Pressure-relieving and Depressuring Systems. API Std 526 American Petroleum Institute (2002) Flanged Steel Pressure Relief Valves API Std 527 American Petroleum Institute (1991) Seat Tightness of Pressure Relief Valves PD5500: 2003 British Standard Specification for unfired fusion welded pressure vessels BS6759-3 British Standard (1984) Safety Valves: Specifications for safety valves for process fluids EN ISO, Safety Devices for protection against excessive pressure Part 1: Safety Valves (EN ISO 4126-1); - Part 2: Bursting Disc Safety Devices (EN ISO 4126-2, 2003); - Part 3: Safety valves and bursting disc safety devices in combination (EN ISO 4126-3, 1995); Part 4: Pilot-operated safety valves (ISO 4126-4, 1999); - Part 6: Application, selection and installation of bursting disc safety devices [EN ISO 4126-6, 2000] ASME VIII (2001) Boiler and pressure vessel code The Institute of Petroleum (2001) Guidelines for the safe and optimum design of hydrocarbon pressure relief and blowdown systems, ISBN 0 85293 287 1 The above codes, standards and guidance are applicable to relief systems on all types of installation [fixed, FPSO and for well test equipment on drilling installations]. Relief systems associated with plant on new installations and new plant on existing installations should have been designed to the current version of the above codes and standards. Relief systems on older installations may have been designed to superseded codes, eg BS 1515 Pressure Vessel Code, BS 2915 Specification for Bursting Discs and Bursting Disc Devices.
2.
Where a standard/code of practice other than those listed above has been employed, judgement as to the adequacy of the relief systems can only be assessed on an individual basis, and the duty holder should be required to justify why its procedures/practices in the relevant areas will deliver an equivalent level of health and safety performance. Relevant Legislation, ACOP and Guidance Include: Offshore Installations (Safety Case) Regulations 2005, Schedule 2, para 13
3.
4.
Specific Technical Issues: 4.1 There are important differences between proportional relief valves/check valves and safety relief valves. Swagelok proportional relief valves/check valves do not meet the requirements of the ASME Boiler and Pressure Vessel Code Section VIII. See Product Notice issued by Swagelock Feb/Mar 2002.
136
4.2 Failures of bellows in balanced bellows type relief valves have occurred. As a result some operators have modified the bonnet vents of balanced bellows pressure relief valves rather than tackling the underlying causes. However, such modifications may adversely affect the valves performance with serious health and safety consequences. See Safety Notice 2/2002. 4.3 A review of lessons learned from past incidents is given in Section 6 of Institute of Petroleum (2001) Guidelines for the safe and optimum design of hydrocarbon pressure relief and blowdown systems. 4.4 Modifications to existing facilities may have altered the duty subsequently required of a relief device or system/subsystem. It is important, therefore, that confirmation is obtained that potentially affected relief duties/devices have been reassessed as part of the design of the modifications. 5. Other Related Assessment Sheets in this Section are: 5.1.F16 5.1.F17 5.1.HS17 6. High Integrity Protection Systems [HIPS] Blowdown/Flare System Flare Towers
7.
8.
137
5.1.F16:
1.
High Integrity Protection Systems [HIPS]
Confirmation should be obtained that the HIPS has been designed to recognised standards/codes of practice. Recognised standards include: UKOOA Guidelines for Instrument Based Protective Systems IEC 61508 Functional safety of electrical/electronic/programmable electronic safety related systems IEC 61511 Functional safety. Safety instrumented systems for the process industry sector HIPS provide an instrumented means of protecting plant & equipment from conditions outside the design basis. Normally this will relate to excess pressure although it could relate to extremes of temperature [hot or cold]. HIPS are sometimes also referred to as HIPPS [high integrity pressure protection system] or OPPS [overpressure protection system].
2.
Where a standard/code of practice other than those listed above has been employed, judgement as to the adequacy of the HIPS can only be assessed on an individual basis. In these cases the duty holder should be required to justify why the methods employed will result in an equivalent level of safety to that required in the referred standards. Relevant Legislation, ACOP and Guidance Include: Offshore Installations (Prevention of Fire and Explosion, and Emergency Response) Regulations 1995, Regulation 9 Provision and Use of Work Equipment Regulations 1998, Regulation 18 and Guidance paras 272-275
3.
4.
Specific Technical Issues: 4.1 The duty holder should be required to demonstrate that an inherently safer alternative to HIPS is not reasonably practicable. 4.2 Where there are interdependencies between HIPS equipment and emergency shutdown equipment the HIPS performance detailed assessment may be required to establish whether the claimed benefits of the HIPS can be fully realised. 4.3 Where fast HIPS response [<10 seconds] is required detailed assessment may be required to confirm the required response time has been properly established and that HIPS performance can be readily verified. 4.4 Where the HIPS is to be located subsea detailed assessment may be required because of the limited field experience in this environment. 4.5 Generally functions implemented by HIPS will have a target SIL of 2 or 3. Targets lower than these may be reasonable but may require detailed assessment to confirm the suitability of the performance standard. 4.6 The use of software for the central logic of any SIL 3 HIPS is novel in the UKCS and outside the recommendations in the UKOOA Guidelines. The duty holder should provide a detailed justification for such software and the justification should be subject to detailed assessment.
5.
Other Related Assessment Sheets in this Section are: 5.1.F8 Safety Integrity Levels Standards
138
5.1.F14 5.1.F18 6.
Inherent Safety Shutdown Systems
7.
8.
139
5.1.F17:
1.
Blowdown/Flare Systems
Confirmation should be obtained that blowdown and flare and vent systems have been designed and constructed in accordance with a recognised standard/code of practice. Recognised standards/codes of practice would include: API RP 521 American Petroleum Institute (1997) Guide for Pressure Relieving and Depressuring Systems The Institute of Petroleum (2001) Guidelines for the Safe and Optimum Design of Hydrocarbon Pressure Relief and Blowdown Systems ISBN 0 85293 287 1 The above codes, standards and guidance are applicable to blowdown flare systems on all types of installation [fixed, FPSO and for well test equipment on drilling installations].
2.
Where a standard/code of practice other than those listed above has been employed, judgement as to the adequacy of the blowdown/flare systems can only be assessed on an individual basis, and the duty holder should be required to justify why its procedures/practices in the relevant areas will deliver an equivalent level of health and safety performance. Relevant Legislation, ACOP and Guidance Include: Offshore Installations (Safety Case) Regulations 2005, Schedule 2 para 13
3.
4.
Specific Technical Issues: 4.1 Staggered or staged blowdown of sections of plant may be specified where the flare/vent system capacity is limited. The assumptions on which the design is based and any philosophy for the order in which sections of plant undergo blowdown should be clear. Where plant modifications have occurred confirmation should be obtained that checks have/will be carried out to confirm that stagings and timings are still achievable. 4.2 Tie-in of new developments may impose higher flows and lower temperatures on existing relief and vent systems. The impact of these conditions and the implications of any mitigating measures, eg staged blowdown, temperature trips to inhibit blowdown, should have been addressed. 4.3 A detailed reliability study should have been undertaken on closed flare or vent systems. The assumptions on which the design is based should be clear. The IVB should have had an opportunity to comment on and influence the design. It is likely that an actuated block valve in parallel with a bursting disc will have an overall probability of failure on demand [PFD] of about 2E-04 and therefore be SIL3. Three devices in parallel: block valve, bursting disc and buckling pin valve, with a PFD of ~2E-06, have been used by some duty holders. To achieve these levels of reliability annual or more frequent testing of all systems should be specified. The implementation of these test intervals would be a suitable topic for post-acceptance inspection. See sheet 5.1.F16 on HIP systems. 4.4 A review of lessons learned from past incidents is given in Section 6 of Institute of Petroleum Guidelines for the safe and optimum design of hydrocarbon pressure relief and blowdown systems. This guide includes checklists for assessment of relief and blowdown systems [pp 100-102] for both designers and operators. 4.5 If a locked open valve is located downstream of a blowdown valve/restriction orifice, the pipework up to and including the locked open valve should be rated at the full pressure of the upstream system. The locked valve can be used to test the functionality of
140
the BDV without blowing down the plant. In these circumstances the pipework downstream of the orifice may fail if it is rated for the lower pressure of the flare system. 5. Other Related Assessment Sheets in this Section are: 5.1.F15 5.1.F16 5.1.HS17 6. Relief Systems High Integrity Protection Systems [HIPS] Flare Towers
7.
8.
141
5.1.F18:
1.
Shutdown Systems
Confirmation should be obtained that shutdown systems have been designed for recognised standards/code of practice. Recognised standards for trip systems include: UKOOA Guidelines for Instrument Based Protective Systems IEC 61508 Functional safety of electrical/electronic/programmable electronic safety related systems IEC 61511 Functional safety. Safety instrumented systems for the process industry sector API RP14C Recommended practice for analysis, design, installation and testing of basic surface safety systems for offshore production platforms Shutdown systems provide an instrumented means of protecting plant and equipment from conditions outside the design basis. By isolating inventories and effecting blowdown they also provide means for mitigating some of the hazards arising following loss of containment.
2.
Where a standard/code of practice other than those listed above has been employed, judgement as to the adequacy of the protection systems can only be assessed on an individual basis. In these cases the duty holder should be required to justify why the methods employed will result in an equivalent level of safety to that required in the referenced standards. Relevant Legislation, ACOP and Guidance Include: Provision and Use of Work Equipment Regulations 1998, Regulation 18 Offshore Installations (Prevention of Fire and Explosion, and Emergency Response) Regulations 1995, Regulation 12
3.
4.
Specific Technical Issues: 4.1 Where the shutdown function includes shutting subsea wells and the subsea wellhead valves do not close on loss of communication with the host platform the design should be subject to detailed assessment. 4.2 Where the closure of an import ESDV could lead to pressure exceeding the design pressure of the corresponding import pipeline the design should be subject to detailed assessment 4.3 Where the ESD equipment has not been subject to a survivability analysis the design should be subject to detailed assessment.
5.
Other Related Assessment Sheets in this Section are: 5.1.F8 5.1.F16 Safety Integrity Levels Standards High Integrity Protection Systems [HIPS]
6.
7.
142
8.
143
5.1.F19:
1.
Alarm and Trip Systems
Confirmation should be obtained that alarm and trip systems have been designed for recognised standards/codes of practice. Recognised standards for alarm and trip systems include: UKOOA Guidelines for Instrument Based Protective Systems IEC 61508 Functional safety of electrical/electronic/programmable electronic safety related systems IEC 61511 Functional safety. Safety instrumented systems for the process industry sector API RP14C Recommended practice for analysis, design, installation and testing of basic surface safety systems for offshore production platforms Recognised standards for alarm systems include: EEMUA Document 191 Alarm system guidance Trip systems provide an instrumented means of protecting plant and equipment from conditions that could lead to circumstances outside the design basis. Alarm systems provide a means of warning operators that plant conditions are deviating significantly from normal or for alerting operators to take mitigating action after an incident. Trip systems shutdown items of plant when significant deviations from normal occur.
2.
Where a standard/code of practice other than those listed above has been employed, judgement as to the adequacy of the alarm/trip system can only be assessed on an individual basis and the duty holder should be required to justify why the methods employed will result in an equivalent level of safety to a design which is in compliance with the reference codes and standards. Relevant Legislation, ACOP and Guidance Include: Provision and Use of Work Equipment Regulations 1998, Regulation 18
3.
4.
Specific Technical Issues: 4.1 If there are situations on plant where an operator response to an alarm condition is required to prevent conditions exceeding the design basis of the plant then the plant design does not follow the principles of inherently safer design. In such cases the duty holder should be required to justify in detail why none of the inherently safer options is reasonably practicable. 4.2. For an alarm system to function properly there must be an effective interface to the process operator. EEMUA Document 191 addresses ergonomic issues relating to alarm presentation and information overload. A detailed assessment of this area will involve consideration of human factors.
5.
Other Related Assessment Sheets in this Section are: 5.1.F8 5.1.F16 5.1.F18 Safety Integrity Levels Standards High Integrity Protection Systems [HIPS] Shutdown Systems
6.
144
Section 11 7.
Human Factors
8.
145
5.1.F23:
1.
Isolations
Confirmation should be obtained that isolation procedures are in accordance with recognised standards or codes of practice which includes: Oil Industry Advisory Committee -The safe isolation of plant and equipment
2.
Where a standard/code of practice other than that listed above has been employed, judgement as to the adequacy can only be made on an individual basis and the duty holder should be requested to justify why equivalent standards of safety should result. Relevant Legislation, ACOP and Guidance Include: Offshore Installations (Safety Case) Regulations 2005, Regulation 12(1)(c) Assessment Principles for Offshore Safety Cases [APOSC], para 72 Provision and Use of Work Equipment Regulations 1998, Regulation 19
3.
4.
5.
6.
Cross-Referenced Sections and Sheets are: Sheet 11.G7 Permit to Work Systems
7.
8.
146
5.2 LOSS OF CONTAINMENT PIPELINES

1. Scope This Section provides guidance for the assessment of safety case content, with respect to pipelines which may affect an offshore installation, from hazard identification and risk evaluation to risk management measures. It covers the major accident hazards associated with major accident hazard pipelines. 2. Assessment of Adequacy of Demonstration A number of major accident hazard initiators have been identified which could affect the integrity of a pipeline system. The assessor should examine the adequacy of the hazard identification, initiators, risk evaluation and management in conjunction with the contents of the categorisation table. The main hazard sources are:

3.
fixed risers [5.2.HS1] other risers including flexible risers [5.2.HS2] outboard pipelines (eg interfield, intrafield, trunk lines, etc.) [5.2.HS3] emergency shutdown valves (ESDV) [5.2.HS4] subsea isolation systems (SSIS) [5.2.HS5] pig traps (including sphere launchers/ receivers) [5.2.HS6]
Depth of Assessment It is important that safety case assessment is not used as the vehicle for dealing with matters more properly addressed by The Pipelines Safety Regulations 1996 (SI 1996/825). The assessment should therefore be limited to ensuring that a duty holder has included an adequate description of all pipelines, including design parameters as necessary, and evaluating the impact of pipelines and their inventories on the overall case for safety. This section gives guidance on the depth of assessment required to determine the adequacy of the demonstration that measures have been or will be taken to ensure compliance with the relevant statutory provisions. Where safety case contents match with good practice identified in the assessment sheets for a particular topic associated with a major accident, there will usually be no need for an assessor to probe into the details of how good practice is applied. This may, however, be a suitable issue to follow-up through inspection.
147
Loss of Containment - Pipelines Source of Hazard
HS1 HS2 Rigid Riser Other Risers including Flexible Risers Outboard Pipeline ESDV Valves (ESDV) Subsea Isolation Systems (SSIS) Pig Trap G1 G2
Initiators
External Corrosion Internal Corrosion F1
Risk Evaluation
Frequency Generic Historic data [PARLOC] Company & Pipeline System Data Pipeline system studies - HAZID F14

Inherent Safety - fully rated pipelines & risers
Temperature & Pressure Rating Material specification
HS3 HS4 HS5
G3 G4 G5
Erosion Overpressure High Temperature
F2 F3
- riser routine - inherent impact resistance - pipe burial & trenching
Corrosion allowance Fatigue life Frequency of inspection
HS6
G6 G7 G8 G9 G10 G11
Low Temperature Fatigue/Vibration Fire [Section 5.3] Fitting Failure Incorrect Installation Operator Error Inadequate Training [Section 11] Operator Error Inadequate Competency [Section 11] F4 F5 F6
- HAZOPs - FMEAs - Design reviews Equipment layout Company standards/competence Corrosion/erosion allowance F15 F16 F17
- concrete ballast costing
Relief arrangements & capacity Reliability of protective systems
Prevention Relief systems HIPS systems Shutdown systems
Adequacy of supports
Risers Temperature & pressure rating
G12
F7
Operations/Maintenance procedures
F18
Alarms/trips
Material specification Corrosion allowance
148

G13
Initiators
Violation [Section 11] F8
Risk Evaluation
SIL standards F19

Cathodic protection
Fatigue life Frequency of inspection
G14
Deficient Procedures Operational [Section 11] Deficient Procedures Maintenance [Section 11] Ship Collision [Section 2] Dropped Object Seismic Event [Section 3] Missile [eg turbine blade] Ageing/Mechanical Degradation Abnormal External Load Helicopter Collision/ Rollover [Section 8] Inadequate Design
F9
Equipment selection
F20
Good procedures
Relief arrangements & capacity
G15
F10
Concept selection
- operational [control of erosion/internal corrosion temperature during blowdown] F21 Competent personnel Monitoring & Audit systems Isolation and PTW controls Intelligent pigging
Reliability of protective systems Adequacy of supports Fire protection Pig Traps Temperature & Pressure Rating Material specification Corrosion allowance
G16 G17 G18 G19
Consequences F11 Size of release - Speed & effectiveness of detection & response - blowdown system F12 Dispersion
F22 F23 F24
G20 G21
F25 F26
Wall thickness monitoring Inhibition performance monitoring
Fatigue life Frequency of inspection Relief arrangements & capacity
G22
F13
Toxicity Refer to Section 12
F27
Fire protection - active
Reliability of protective systems
G23
Ignition Refer to Section 5.3
- passive
Adequacy of supports Integrity of closure seals
149

G24 G25 G26 G27 G28
Initiators
Incorrect Material Specification Thermal Radiation Slugging/Water Hammer Structural Support Failure [Section 3] Fishing Gear Snagging Anchor Snagging/Dropping G30 Explosion Overpressure
Risk Evaluation
F28 F29 F30 F31 F32

Anchor pattern controls Fail safe system Pre-operation strength & leak testing NDT inspection Condition monitoring
Fire protection Valves Temperature & pressure rating Material specification Corrosion allowance Closure mode
G29
F33 F34
Gas detection Fire detection
Integrity of seals Leakage rate
150
5.2.HS0:
1.
The Pipeline System
Pipeline System Overview General requirements for assessment: A statement that the person responsible for the operation of the pipeline has responsibility for the entire length of the pipeline (including risers, pig traps etc.). A statement of who is responsible for starting up the pipeline at any time following a shutdown, and the procedures and checks which are made before start up. Confirmation that the person(s) responsible for the inspection and maintenance of the pipeline has responsibility for the entire length of the pipeline. A description of the inspection and maintenance arrangements summarising and justifying the methods of inspection of the pipeline to the identified hazard limit distance from the installation (the distance beyond which a pipeline rupture could not conceivably cause danger to the platform), the management system for carrying out the inspection work, recording it, storage of the records, deciding on requirement and scope for remedial work, including methods of control of contractors. A description of procedures to satisfy the operation, maintenance and testing requirements for the ESD valves, demonstrating that any leakage has been assessed and found not to be excessive. A statement that damage prevention procedures are in place, including a list of identified hazards (eg dropped cargo, anchors, mooring lines, vessels, etc.) and any limitations imposed (no anchoring areas, vessel size limitations, approach routes, etc). A description of procedures to be followed for modifications and repairs, including safety studies, how isolation procedures are decided upon and how the standards of work and inspection are set. A statement that there are emergency procedures to cover all identified hazards, a list of the titles of all emergency and operating manuals applicable to the pipelines connected to the installation, the distribution list of installations at which the emergency manuals are present, who is involved in writing and updating the emergency manuals, the update frequency and the events which trigger an update, the management system for making and communicating day to day changes, the content of procedures stating the type of emergency/ hazard and main actions to be taken (eg which valves to close), with pipeline system diagrams in support, if necessary, and a statement or diagram showing responsibility interfaces with other operators. A statement that procedures are in place, and a summary description, to cover simultaneous production and diving, or any other form of maintenance, at a subsea manifold/well connected by pipeline to the installation, or on the pipeline itself, to control any hazards arising which could affect the diving support vessel, its crew or divers, or the installation. A description of connections between the installation and subsea manifolds/ wells or normally unattended satellites. A description of all past modifications and repairs to the pipelines which could have a bearing on the other parts of the safety case, namely the system description, hazard identification, risk evaluation and reduction.
2.
Where a standard/code of practice other than those listed in Annex 1 and Sheets 5.2.HS1-6 has been employed, judgement as to the adequacy can only be assessed on
151
an individual basis and the duty holder should be required to justify that the applied standard/code will be equally effective. 3. Relevant Legislation, ACOP and Guidance includes: Pipelines Safety Regulations 1996, in particular Regulations 5-17, 18-24, Schedules 2-5 and associated Guidance Document L82 Offshore Installations (Safety Case) Regulations 2005 and associated Guidance Document L30 Offshore Installations (Prevention of Fire and Explosion, and Emergency Response) Regulations 1995 and associated ACOP and Guidance Document L65 Assessment Principles for Offshore Safety Cases [APOSC], in particular paragraphs 9, 14, 16, 95, 115 Provision and Use of Work Equipment Regulations 1998, in particular Regulations 4, 5 and 12 4. Specific Technical Issues: The pipeline system should be described and then that information used to check the identification of hazards and to ensure that they have been addressed. The safety case should be checked to find any anomalies which may exist in the hazard identification results and to track down faults in method. Safety cases should identify all hazards arising from pipelines or their inventories that could give rise to major accidents the most significant major accident hazards are covered in Sheets 5.2.HS1 to HS6. Hazard identification should take account of pipeline systems aspects such as management interfaces between installations, inter-platform control, telemetry, leak detection and pipelines emergency procedures. All hazards which could result in a loss of pipeline integrity at any location within the hazard limit distance [5.2.HS3] should be identified and included in the overall risk assessment for the installation. The hazard limit distance is that distance from the installation beyond which a pipeline release could not conceivably be a hazard to the installation. The hazards involving any pipeline attached to subsea wells or manifolds, which could endanger drilling rigs or diving support vessels should be identified. An assessment should be made to show that risks have been evaluated and that these analyses have been carried forward into the overall risk assessment for the installation. Checks should be made of the adequacy of proposed hazard minimisation or risk reduction measures and that they are consistent with the overall risk assessment. Within the installation description the duty holder should include all interconnecting facilities ie pipelines and subsea installations, including:
a description or diagram of connections to pipeline systems and of any pipeline with the potential to cause a major accident; owners and operators of connected installations and interfaces; fluids, pipeline sizes, directions, and approximate flow rates; subsea valves, tees, wyes, remotely operable valves, etc.; telemetry links to other installations;
152
all potential pressurising sources (eg subsea wells, other pipelines connected subsea, pumps and compressors, etc.); process flow diagrams of any subsea production facilities, showing actuated and manual valves; complex operations (eg hot water circulation, chemical injection, water or gas injection, gas lift, etc.) or where dual (or multiple) purpose lines are used (eg round-trip pigging); liquid/gas separation or pumping facilities; a description of the pipeline over-pressure protection system (see below); a description of the leak detection system (see below); and pipeline pigging philosophy and practice.
Specific pipeline data should include:
pipe diameter; wall thickness(es), stating any allowance for corrosion; the pipeline platform approach route; the riser, topsides pipework and demarcation points; pipeline inventory at maximum allowable operating pressure between the pipeline extremities (ie from installation to installation, including any branches connected subsea); the ESDV and any subsea isolation system; the fluids in the pipeline; the design standard or code used for the pipeline; the existence of any weight coating; the current maximum allowable operating pressure; the operating temperature range; the grade of steel/ material of construction of the pipeline, riser and topsides pipework, including whether it is sour/non-sour service rated, and the type of any cladding. (In the case of duplex or other special materials for which an industry specification may not exist, the safety case should state, for example, the composition, specified minimum yield stress, the type of pipe (eg steel, flexible, duplex, bundle)); the arrangements for corrosion management, including monitoring and control of corrosion, internally and externally, and predicted corrosion rates; and any other element of the design of the pipeline which is critical to the safety of the installation.
Damage Prevention
153
The pipeline should be protected from third party and/or construction damage by vessel anchors and mooring wires and chains, by pipe lay abandon and retrieval wires, and by fishing trawls. Also, consider the anchoring procedures for standby vessels, supply vessels, diving support vessels, heavy lift crane vessels, flotels, drilling rigs, etc. Major damage risks come from dropped objects (eg cargo being loaded offshore) and from vessel collisions with risers. Exposed risers should be protected with fenders or equivalent, and procedures should be in place to limit vessel sizes and types, weather conditions for loading, etc. Pipeline spool-pieces located under platform cranes should be protected from dropped cargo containers, well casings, etc. Procedures should be in place to limit the types and weights of items of cargo to be handled to ensure that they do not exceed the design of the pipeline protection. A further cause of damage is due to jack-up spud cans making deep holes in the seabed into which a pipeline can slip. Protection Assessment of protection requirements, its type and extent, for all parts of the pipeline should be carried out. The assessor should be aware of relevant standards and should use them as a guide as to whether studies have produced credible results. The studies should cover hazard identification, risk evaluation and risk reduction. Pipeline Safety Systems The duty holder should describe all the safety systems in place for safe operation, safety of personnel and prevention of hazard escalation. The performance standards required of these systems should be described. For example, how often they may fail the tests without having to be replaced, how fast are they expected to react, etc. The safety systems are intended to cover the greatest and most frequent hazards, and they should provide the fastest response and warning of hazards. Emergency procedures are intended to cover the rest. The assessor should examine the installed safety systems, as described in the safety case, and should compare this description with the results of the hazard identification. The hazard identification should identify the critical safety system components. These components should be prominent in the testing and maintenance scheme, and certainly should be mentioned in the method of devising and updating it. The assessor should examine the emergency procedures in the light of the installed systems. Pipeline Over-pressure Protection and Depressurisation The safety case should describe the type and operation of any pipeline over-pressure protection and depressurisation measures in place (other than pig trap systems). This will mainly involve relief systems for pipeline sections in-board of ESD valves (with high pressure trips). Pressure breaks should be examined critically. The primary protection should be by design ie the pipeline should be designed for the highest foreseeable pressure (inherently safe design). Secondary protection may include pressure safety valves (spring operated), HIPS [5.1.F16], etc. The pipeline depressurisation philosophy should detail reasons for the need for depressurisation and any limitations or controls in place to mitigate potential low
154
temperature, embrittlement and hydrate formation problems (eg controlled depressurisation rate with methanol injection). There should be a description of all available means of depressurisation of the pipelines which could be used in an emergency, referring to the pipeline system description if necessary, and the emergency procedures - although operators are naturally reluctant to flare off large quantities of gas, methods exist for rapid removal of substantial quantities with co-operation from other users of a pipeline system. Pipeline Leak Detection The duty holder should describe the type and operation of the pipeline leak detection system, including control functions monitored, monitoring locations (eg at each end of the pipeline) and the alarm and shutdown set points for these functions. This should include:
the actions resulting, eg alarms in the control room and who takes actions to shutdown? How are third parties and the beach informed? what is the response time against leak size and what are the criteria used for shutdown?
Pipeline Emergency Shut-Down Functions The safety case should give a satisfactory definition of the emergency shut-down facilities. The levels of shut-down should be clearly defined. The description should include the list of initiating parameters from the pipeline system and resulting actions on the pipeline system for each level of shut-down. In particular, the level at which the riser ESD valves are closed. All operation and failure modes should be described, including local/test controls, and the various failsafe closure modes. Are there functions built into the ESD system to receive/send shutdown signals from/to third parties, or to alarm them of ESD valve closure, or are these all manual actions by the operator? If SSIVs are installed, all modes of operation and failure should be described. Are they tied back into the ESD system and automatically actuated, at a certain shut-down level, or are they manually initiated? Where pipeline blow-down facilities or procedures are in place, their mode of operation should be clearly defined. Is the pipeline blow-down automatic or manually initiated? Is it controlled to prevent potential hydrate and pipeline low temperature problems? Connection to Pipeline Systems Communication, power and telemetry links to other installations: this aspect is required to verify claims of automatic shutdown capabilities, data transfer, etc., and will be used in detail in relation to safety systems. Fluids, approximate operating pressures and line sizes. The well head shut-in pressure of subsea wells connected to the installation: the maximum allowable operating pressure (MAOP) rating of the relevant riser should be above this pressure; The MAOPs of all pipelines connected subsea to each riser: for any particular riser these should all be equal to avoid the possibility of overpressurisation from a third party platform;
155
High pressure shut down set points for pumps and compressors and other pressure sources connected to the pipeline: these should all be less than the MAOP; Location of pipeline system control centre, especially when tying into major transportation systems. If the considerations mentioned above in connection with MAOPs are not satisfied, the MAOP should be adjusted accordingly, or a high integrity pressure limiting or shutdown system should be in place. Such a system should be examined in detail. For pipeline operations further information may be required by assessors to be included ie where operators submit a joint safety case for a number of installations such as subsea manifolds/wells or unmanned satellites connected to a central platform. Subsea Facilities These may be remote from the installation but connected to it, and details should be included of:
satellite wells and protection afforded to these remote installations; modes of control of the facilities; process flow diagrams, showing actuated and manual valves, where dual (or multiple) purpose lines are used (eg round trip pigging), or complex operations are intended, eg. hot water circulation, methanol, chemical, water/ gas injection, provision for gas lift etc.; and details of any liquid / gas separation or pumping facilities.
The duty holder should take account of the possible hazards from backflow from water injection lines for example, which are apparently non-hazardous. In round trip pigging systems a water line could be connected subsea to a production line. Where the installation is a floater water backflow could sink the vessel. Loss of flow of corrosion inhibitor if undetected could lead to corrosion of a flowline carrying a hazardous fluid. The assessor should take into account hazards from satellite well flowlines due to dropped objects, anchors and mooring lines which could affect crews of drilling and diving support vessels. Has the potential for sand carry-over been considered in the design? This can give erosion problems, particularly at riser bends and at SSIVs. Future Pipelines and Connections to Other Installations The duty holder should give a description of routing, location and layout of known future pipelines and risers. It is important to consider and comment on these aspects at an early stage to ensure that changes can be implemented completely and without unnecessary complication. Pipeline Communications/Control/Telemetry
Within the description of the pipeline communications, control and telemetry systems, the following should be addressed: the transmitted parameters; the criteria necessary for correct operation (ie limitations of the equipment in terms of environmental or other conditions);
156
action of the installed system on loss of communication/ control/ telemetry links, and manual intervention procedures: usually the pipeline should be shut down; remotely controlled action that can be taken under major accident conditions by inter-connected installations, and the sequence and timing of such actions, including emergency shut-down arrangements; and shore-based control systems.
Pipeline Operations The duty holder should state the expected frequency and purpose of pigging throughout the field life. The duty holder should summarise the inspection scheme for each part of the pipeline, describing the techniques used and justifying their adequacy with consideration to conditions such as currents/sand waves, wave action, corrosion, fishing and other activity. For ESD valves testing and inspection activities should be covered under this heading. Testing of ESD, control, telemetry and communication systems should be included. Any special equipment used for inspection should be described, such as intelligent pigs, ESD valve seat leak testing facilities, new technology, etc. For all cases of leaking seats on ESD valves the duty holder should demonstrate that the effects have been assessed and that appropriate action has been or will be taken. This should be covered in the safety case as the summary of an assessment study. The duty holder should provide the maintenance schedule and demonstrate that adequate maintenance is carried out. Parts which are expected to be included are valves, actuators, pig trap closures, control, telemetry and communication systems, riser tensioners and quick-disconnect systems on floating production platforms, and any other mechanical equipment. Operating Temperatures The assessor should recognise the potential for:
hydrate formation which can lead to blockage problems and possible ineffectiveness of safety systems; formation of process condensates which may lead to pipeline slugging conditions, for which the pipeline may or may not be designed; wax formation in oil lines which may lead to blockage of critical components; ice formation on the outside or inside of valves which may render them inoperable; low temperature embrittlement of pipe steel; and failure of blowdown systems.
Process Upset Conditions Examples of process upsets include slugs, surges and emergency shut-downs. Some system designs rely upon the processes not going outside certain parameters, eg a dry sour gas line if not designed for sour service must not get wet due to a process upset. What systems are in place to warn operators or to shut down the line in this type of situation?
157
Decommissioning and Abandonment Taking a pipeline out of use falls under two main headings - cleaning out of hazardous substances from pipelines, risers and topsides, and ensuring safe removal of facilities as required. For pipelines this subject involves principally the safety of divers and of other personnel involved with platform abandonment. 5. Other Related Assessment Sheets in this Section are: 5.2.HS1 5.2.HS2 5.2.HS3 5.2.HS4 5.2.HS5 5.2.HS6 6. Rigid Riser Other Risers including Flexible Risers Outboard Pipeline ESDV Valves (ESDV) Subsea Isolation Systems (SSIS) Pig Trap
Cross-Referenced Sections and Sheets are: Section 3 Section 4.1 Section 4.2 Section 5.1 Section 5.3 Section 10 Section 11 Section 13 Sheet 2.F6 Loss of Structural Integrity Loss of Maritime Integrity - Loss of Stability Loss of Maritime Integrity - Loss of Position Loss of Containment - Process Loss of Containment - Fire and Explosion Emergency Response Human Factors QRA SBVs, Communications & Procedures
7.
Lead Assessment Unit for this Sheet: SI3
8.
Team responsible for authoring and updating this sheet: SI3B
158
5.2.HS1:
Rigid Risers
[Relevant Sheets: 5.2.G1, 5.2.G2, 5.2.G3, 5.2.G4, 5.2.G6, 5.2.G7, 5.2.G8, 5.2.G9, 5.2.G10, 5.2.G16, 5.2.G17, 5.2.G19, 5.2.G20, 5.2.G21, 5.2.G23, 5.2.G24, 5.2.G25, 5.2.G27, 5.2.F1, 5.2.F2, 5.2.F3, 5.2.F4, 5.2.F6, 5.2.F7, 5.2.F9, 5.2.F10, 5.2.F11, 5.2.F12, 5.2.F13, 5.2.F14, 5.2.F15, 5.2.F16, 5.2.F17, 5.2.F18, 5.2.F19, 5.2.F20, 5.2.F24, 5.2.F25, 5.2.F26, 5.2.F27, 5.2.F30, 5.2.F31, 5.2.F32] 1. The riser is one of the most important parts of the pipeline system and its integrity has to be assured. All information relating to risers should be assessed from the seabed to either the emergency shutdown valve (ESDV) or the pig trap (if fitted). In particular:
approximate route (eg showing relevant module decks, bulkheads and jacket members, riser supports/ guides); ESDV location; mechanical joints, eg flanged and insulation joints; all branches outboard of the ESDV as far as their respective isolation valve(s) and their nominal diameter; and fire, explosion, impact or other protection provided for the riser and ESDV.
Confirmation should be obtained that the pipeline operator/duty holder has ensured that the pipeline riser has been properly designed and constructed and is operated safely to ensure that the riser will be in accordance with recognised standards and guidance. These include: BS 4515-1 Specification for the Welding of Steel Pipelines on Land and Offshore Part 1: Carbon and Carbon Manganese Steel Pipelines BS 4515-2 Specification for the Welding of Steel Pipelines on Land and Offshore Part 2: Duplex Stainless Steel Pipelines ISO 13847 Pipeline Welding ISO 15590 Part 1 Induction Bends ISO 15590 Part 2 Fittings ISO 15590 Part 3 Flanges ISO 15589 Part 2 Cathodic Protection Offshore ISO 3183 Petroleum and Natural Gas Industries Steel Pipe for Pipelines API 5L Line Pipe High Integrity Pressure Protection Systems (HIPPS) for the Overpressure Protection of Pipelines (Draft) 2. Where a standard/code of practice other than those listed above has been employed, judgement as to the adequacy can only be assessed on an individual basis and the duty holder should be required to justify that the applied standard/code will be equally effective. Relevant Legislation, ACOP and Guidance includes:
3.
159
Pipelines Safety Regulations 1996, in particular Regulations 5-17, 18-24, Schedules 2-5 and associated Guidance Document L82 Offshore Installations (Safety Case) Regulations 2005 and associated Guidance Document L30 Offshore Installations (Prevention of Fire and Explosion, and Emergency Response) Regulations 1995 and associated ACoP and Guidance Document L65 Assessment Principles for Offshore Safety Cases [APOSC], in particular paragraphs 9, 14, 16, 95, 115 Provision and Use of Work Equipment Regulations 1998, in particular Regulations 4, 5 and 12 4. Specific Technical Issues: Riser Routing and Design The duty holder should, with the aid of schematics, describe the riser routing in relation to platform, pipeline platform approaches and field layout. This is necessary from the assessor's point of view to enable him to assess the full impact of layout versus topsides and vessel activities. The riser should, where possible, be routed away from hazards such as fire, explosion and impact. Specific issues to be addressed include:
position of cranes, which will be used for loading vessels; whether an external riser is located on the weather side of the platform, making it vulnerable to impacts from drifting vessels, especially important where there is also a crane on that side; fire protection; accessibility for inspection, ie when located in caissons or in platform legs; gas risers in concrete platform legs, which could leak and pressurise the leg causing it to collapse; and adequate support of the riser, especially in the wave zone.
Risers should ideally be located in-board of jacket braces or other structural members to protect them from vessel impact. If not, there should be fenders or other means installed which can absorb impact energy without touching the riser. Where risers are located in J-tubes (conduits) or in caissons, the J-tubes or caissons should be sealed off at both ends and filled with inhibited water to protect the riser from corrosion. 5. Other Related Assessment Sheets in this Section are: 5.2.HS3 5.2.HS4 5.2.HS5 5.2.HS6 6. Outboard Pipelines ESDV Valves (ESDV) Subsea Isolation Systems (SSIS) Pig Trap
160
Section 3 Section 4.1 Section 4.2 Section 5.1 Section 5.3 Sheet 2.F6 7.
Loss of Structural Integrity Loss of Maritime Integrity - Loss of Stability Loss of Maritime Integrity - Loss of Position Loss of Containment - Process Loss of Containment - Fire and Explosion SBVs, Communications & Procedures
8.
161
5.2.HS2:
Other Risers including Flexible Risers
[Relevant Sheets: 5.2.G1, 5.2.G2, 5.2.G3, 5.2.G4, 5.2.G6, 5.2.G7, 5.2.G8, 5.2.G9, 5.2.G10, 5.2.G16, 5.2.G17, 5.2.G19, 5.2.G20, 5.2.G21, 5.2.G23, 5.2.G24, 5.2.G25, 5.2.G27, 5.2.F1, 5.2.F2, 5.2.F3, 5.2.F4, 5.2.F6, 5.2.F7, 5.2.F9, 5.2.F10, 5.2.F11, 5.2.F12, 5.2.F13, 5.2.F14, 5.2.F15, 5.2.F16, 5.2.F17, 5.2.F18, 5.2.F19, 5.2.F20, 5.2.F24, 5.2.F25, 5.2.F26, 5.2.F27, 5.2.F30, 5.2.F31, 5.2.F32] 1. The riser is one of the most important parts of the pipeline system and its integrity has to be assured. All information relating to risers should be assessed from the seabed to either the emergency shutdown valve (ESDV) or the pig trap (if fitted). In particular:
approximate route (eg showing relevant module decks, bulkheads and jacket members, riser supports/ guides); ESDV location; mechanical joints, eg flanged and insulation joints; all branches outboard of the ESDV as far as their respective isolation valve(s) and their nominal diameter; and fire, explosion, impact or other protection provided for the riser and ESDV.
Confirmation should be obtained that the pipeline operator/duty holder has ensured that the pipeline riser has been properly designed and constructed and is operated safely to ensure that the riser will be in accordance with recognised standards and guidance. These include: API Specification 17J 2nd Edition November 1999 Specification for Unbonded Flexible Pipe API RP 17B 2nd Edition July 1998 Recommended Practice for Flexible Pipe ISO 13628-2 Design and Operation of Subsea Production Systems Part 2: Flexible Pipe Systems for Subsea and Marine Operations Other guidance and sources of information: UKOOA Study Report on State of the Art Flexible Riser Integrity Issues MCS International Doc No 2-1-4-181/SR01 Rev 04 April 2001 UKOOA Guidance Note Monitoring Methods and Integrity Assurance for Unbonded Flexible Pipe Rev 5 Oct 2002 API Technical Report TR17RUG The Ageing of PA-11 in Flexible Pipes High Integrity Pressure Protection Systems (HIPPS) for the Overpressure Protection of Pipelines (Draft) 2. Where a standard/code of practice other than those listed above has been employed, judgement as to the adequacy can only be assessed on an individual basis and the duty holder should be required to justify that the applied standard/code will be equally effective. Relevant Legislation, ACOP and Guidance includes: Pipelines Safety Regulations 1996, in particular regulations 5-17, 18-24, Schedules 2-5 and associated Guidance Document L82
3.
162
Offshore Installations (Safety Case) Regulations 2005 and associated Guidance Document L30 Offshore Installations (Prevention of Fire and Explosion, and Emergency Response) Regulations 1995 and associated ACoP and Guidance Document L65 Assessment Principles for Offshore Safety Cases [APOSC], in particular paragraphs 9, 14, 16, 95, 115 Provision and Use of Work Equipment Regulations 1998, in particular Regulations 4, 5 and 12 4. Specific Technical Issues: Risers to floating installations are particularly vulnerable to damage. Steel tensioned risers located under the installation are susceptible to dropped object damage, damage during running and retrieval, and to overstressing or fatigue in certain circumstances. The riser stress analysis should be applicable for all sea states and modes in which the riser can remain connected to the installation. These risers usually include short sections of flexible pipe at the topsides which is susceptible to damage also. Flexible risers are vulnerable to damage from vessels, dropped objects, fatigue and overstress damage. As with the steel tensioned risers the stress analysis should cover all applicable cases. Connections with steel pipe should be configured to avoid the flexible being damaged by bending at the connection, either by their layout or by use of bend restrictors. Riser stress analysis for both of the above types should cover extreme static installation offsets from its station, static wind, wave and current loading, natural frequency analysis, dynamic response to wave frequencies (stresses and fatigue damage assessment) and dynamic transient responses. Operators should be aware of the fatigue lives of the components. At a minimum, assessors should check the design lives of key components which are difficult or expensive to replace regularly, and the limiting sea states for the riser system. Duty holders should provide an isometric drawing of the riser routing(s), showing the module decks and bulkheads through which it passes, from the seabed to the ESD valve/pig trap and the first process isolation valve. The assessor can then use this and module general arrangement drawings, plot plans, etc. to compare with the list of identified hazards to the riser. This drawing should indicate the ESD valve location, the types and positions of riser supports, flange joints, insulation joint, any other weak joint, any branches outboard of the ESD valve to their respective isolation valve(s) and their nominal diameter and any parts of the riser that are not accessible for inspection and fire, explosion, impact or other protection which is fitted. It is not necessary to show topside branches other than the main process flow branch. Any hook-up welds should be shown to indicate the interface between contractors. For floating installations there should also be scale plans and elevations of the risers, showing extreme offset configurations. A description of fire, explosion and impact protection should address:
active and passive fire protection; explosion protection - in terms of segregation by layout and physical partitioning using blast walls;
163

5.
fire & gas detection systems (a rough check of what is in place should be made detailed analysis will be carried out by topsides assessors); and dropped object protection.
Other Related Assessment Sheets in this Section are: 5.2.HS3 5.2.HS4 5.2.HS5 5.2.HS6 Outboard Pipelines ESDV Valves (ESDV) Subsea Isolation Systems (SSIS) Pig Trap
6.
Cross-Referenced Sections and Sheets are: Section 3 Section 4.1 Section 4.2 Section 5.1 Section 5.3 Sheet 2.F6 Loss of Structural Integrity Loss of Maritime Integrity - Loss of Stability Loss of Maritime Integrity - Loss of Position Loss of Containment - Process Loss of Containment - Fire and Explosion SBVs, Communications & Procedures
7.
8.
164
5.2.HS3:
Outboard Pipeline
[Relevant Sheets: 5.2.G1, 5.2.G2, 5.2.G3, 5.2.G4, 5.2.G5, 5.2.G6, 5.2.G7, 5.2.G9, 5.2.G10, 5.2.G17, 5.2.G18, 5.2.G20, 5.2.G21, 5.2.G22, 5.2.G24, 5.2.G28, 5.2.G29, 5.2.F1, 5.2.F2, 5.2.F3, 5.2.F4, 5.2.F6, 5.2.F7, 5.2.F9, 5.2.F10, 5.2.F11, 5.2.F12, 5.2.F13, 5.2.F14, 5.2.F15, 5.2.F16, 5.2.F17, 5.2.F19, 5.2.F20, 5.2.F24, 5.2.F25, 5.2.F26, 5.2.F28, 5.2.F29, 5.2.F30, 5.2.F31, 5.2.F32] 1. It is important to assess in detail the pipeline within 500 metres from the installation, taking into account features such as:
the installation itself; pipeline(s); no-anchoring areas; anchor patterns and jack-up footprints for vessels normally moored in the vicinity; and layout of tie-ins, spool pieces, crossovers, subsea isolation systems (SSISs), other subsea equipment and extent of protection measures such as mattresses, rock dump, trenching, protection covers, etc.
All hazards which could result in a loss of pipeline integrity at any location (within the hazard limit distance ie where the installation could be affected) should be identified and included in the overall risk assessment for the installation. The hazards involving any pipeline attached to subsea wells or manifolds, which could endanger drilling rigs or diving support vessels should be addressed. Assessment should be made of the interaction between the installation and others linked by pipeline(s) and the effect an interconnected pipeline system could have on the installation. Safety cases should identify all hazards arising from pipelines or their inventories that could give rise to major accidents. Hazard identification should take account of parts of pipelines located close to installations whose failure could affect the installation and pipeline systems aspects such as management interfaces between installations, interplatform control, telemetry, leak detection and pipelines emergency procedures. Confirmation should be obtained that the pipeline operator/duty holder has ensured that the outboard pipeline (for example, interfield pipeline, trunk line, etc.) has been properly designed and constructed and is operated safely to ensure that the pipeline will be in accordance with recognised standards and guidance. These include: BS 4515-1 Specification for the Welding of Steel Pipelines on Land and Offshore Part 1: Carbon and Carbon Manganese Steel Pipelines BS 4515-2 Specification for the Welding of Steel Pipelines on Land and Offshore Part 2: Duplex Stainless Steel Pipelines ISO 13847 Pipeline Welding ISO 15590 Part 1 Induction Bends ISO 15590 Part 2 Fittings ISO 15590 Part 3 Flanges
165
ISO 15589 Part 2 Cathodic Protection Offshore ISO 3183 Petroleum and Natural Gas Industries Steel Pipe for Pipelines ISO 21329 Testing Mechanical Connectors API 5L Line Pipe Other guidance and sources of information: SPC/TECH/OSD/18 Health & Safety Issues Associated with Changes from Dry Gas to Wet Gas Operations High Integrity Pressure Protection Systems (HIPPS) for the Overpressure Protection of Pipelines (Draft) 2. Where a standard/code of practice other than those listed above has been employed, judgement as to the adequacy can only be assessed on an individual basis and the duty holder should be required to justify that the applied standard/code will be equally effective. Relevant Legislation, ACOP and Guidance includes: Pipelines Safety Regulations 1996, in particular regulations 5-17, 18-24, Schedules 2-5 and associated Guidance Document L82 Offshore Installations (Safety Case) Regulations 2005 and associated Guidance Document L30 Offshore Installations (Prevention of Fire and Explosion, and Emergency Response) Regulations 1995 and associated ACoP and Guidance Document L65 Assessment Principles for Offshore Safety Cases [APOSC], in particular paragraphs 8, 9, 14, 16, 115 Provision and Use of Work Equipment Regulations 1998, in particular Regulations 4, 5 and 12 Specific Technical Issues: Pipeline to Platform Approaches The duty holder should describe, with scale diagrams:
3.
the layout and configuration of the plant; the connections to be made to any pipeline or installations; and any wells to be connected to the installation.
The scale plan of the location should be large enough to show any features that may be significant in the assessment of the hazard or risk associated with the site. Typically, items of significance include:
pipelines, whether connected to the installation or not; subsea wells and manifolds; control umbilicals; other fixed installations in the area; and
166
any significant undulations in the seabed.
The duty holder should therefore provide a pipeline to installation approaches plan to 500 metres from the installation, showing the installation(s), pipelines, direction of geographical (true or grid) and installation north, no-anchoring areas, anchor patterns for vessels normally moored in the vicinity (and the vessel itself), layout of tie-ins, spoolpieces, crossovers, SSISs, other subsea equipment, extent of protection measures such as mattresses, rock dump, trenching, protection covers, supports and any significant undulations in the seabed elevation which could conceivably cause bending/spanning/upheaval buckling. Note that this is also required for subsea manifolds and producing subsea wells because of potential hazards to drilling rigs, DSVs and their crews. Details of tie-ins, spool-pieces, cross-overs and other subsea equipment such as SSISs should be evaluated to assess risks from dropped objects, fishing activities and anchors. The assessor should consider the effects of having a flotel located over the lines, if this is the case, with respect to dropped object and anchor/ mooring line damage. Similarly jackup temporary moorings used during jacking operations, construction vessels, diving support vessels, and standby vessels should be considered. Moorings for drilling semis (usually but not always located well away from fixed platforms) and jack-ups drilling satellite wells and exploration wells should be considered in connection with the in-field pipeline layout. Duty holders should take account of hazards from satellite well flowlines due to dropped objects, anchors and mooring lines which could affect crews of drilling and diving support vessels. 5. Other Related Assessment Sheets in this Section are: 5.2.HS1 5.2.HS2 5.2.HS5 6. Rigid Riser Other Risers including Flexible Risers Subsea Isolation Systems (SSIS)
Cross-Referenced Sections and Sheets are: Section 3 Section 4.1 Section 4.2 Section 5.1 Section 5.3 Sheet 2.F6 Loss of Structural Integrity Loss of Maritime Integrity - Loss of Stability Loss of Maritime Integrity - Loss of Position Loss of Containment - Process Loss of Containment - Fire and Explosion SBVs, Communications & Procedures
7.
8.
167
5.2.HS4:
ESDV Valves (ESDV)
[Relevant Sheets: 5.2.G1, 5.2.G2, 5.2.G3, 5.2.G4, 5.2.G5, 5.2.G6, 5.2.G7, 5.2.G8, 5.2.G9, 5.2.G10, 5.2.G17, 5.2.G19, 5.2.G20, 5.2.G21, 5.2.G23, 5.2.G24, 5.2.G25, 5.2.G27, 5.2.G30, 5.2.F1, 5.2.F2, 5.2.F3, 5.2.F4, 5.2.F7, 5.2.F9, 5.2.F10, 5.2.F11, 5.2.F13, 5.2.F14, 5.2.F15, 5.2.F16, 5.2.F17, 5.2.F18, 5.2.F19, 5.2.F20, 5.2.F23, 5.2.F24, 5.2.F25, 5.2.F26, 5.2.F27, 5.2.F29, 5.2.F30, 5.2.F31, 5.2.F32] 1. An assessment should be carried out for all ESDVs at an installation with particular reference to the definitions of ESD levels and modes of operation and failure of the ESDVs. Confirmation should be obtained that the pipeline operator/duty holder has ensured that the ESDV has been properly designed and constructed and is operated safely to ensure that the ESDV will be in accordance with recognised standards and guidance. These include: API Spec 6D Pipeline Valves ISO 14313 Pipeline Valves Other Guidance and Sources of Information: Department of Energy Guidance Notes in Support of the Offshore Installations (Emergency Pipeline Valve) Regulations 1989 SI 1989/1029 HSE/UKOOA Guidance On The Setting Of Tolerable Pipeline Riser ESDV Internal Body Seal Leak Rates For Offshore Pipelines (in draft) SPC/TECH/OSD/26 Riser Emergency Shut Down Valve (ESDV) Leakage Assessment 2. Where a standard/code of practice other than those listed above has been employed, judgement as to the adequacy can only be assessed on an individual basis and the duty holder should be required to justify that the applied standard/code will be equally effective. Relevant Legislation, ACOP and Guidance includes: Pipelines Safety Regulations 1996, in particular regulations 5-17, 18-24, Schedules 2-5 and associated Guidance Document L82 Offshore Installations (Safety Case) Regulations 2005 and associated Guidance Document L30 Offshore Installations (Prevention of Fire and Explosion, and Emergency Response) Regulations 1995 and associated ACOP and Guidance Document L65 Assessment Principles for Offshore Safety Cases [APOSC], in particular paragraphs 8, 9, 14, 16, 109, 115 Provision and Use of Work Equipment Regulations 1998, in particular Regulations 4, 5 and 12 4. Specific Technical Issues: ESDV Location The ESDV shall be located in a position:
3.
in which it can be safely and fully inspected, maintained and tested;
168
such that the ESDV is above water; and subject to the above, such that the distance along the riser from the ESD valve to the base of the riser is as short as reasonably practicable.
The duty holder should indicate the ESD valve location(s) on the riser isometric drawing. ESDV Fire, Explosion and Impact Protection The duty holder should demonstrate, through description and general layout drawings, that adequate fire, explosion and impact protection is afforded to the ESD valve and its appurtenances, eg actuator, hydraulic accumulators, hydraulic piping, outboard maintenance valve. It is expected that in order to define the type and extent of protection, the duty holder will carry out detailed studies which should be listed among the references. The assessor should check the scope of these studies and their results. Fire Protection The ESDV actuator and all components necessary for ESDV fail-safe closure should remain fully operable under anticipated fire conditions. The pressure containing capability of the ESDV, including any out-board maintenance valves and any flanged connections to the riser, should be preserved under the anticipated fire conditions. The assessor should check the results of studies against these criteria. Whilst both passive and active fire protection systems may be used, it should be noted that passive systems (coatings, covers, etc) do not require prime movers, distribution systems and an initiation signal, and are therefore likely to be more reliable and have higher integrity than active systems (deluge, etc). Accordingly, active fire protection systems acting on their own may not be sufficient. There should be fire and gas detection in the vicinity of the ESD valve. Explosion Protection It is not usually reasonably practicable to afford protection against all of the effects of an explosion in the immediate vicinity of an ESDV. Operators should conduct studies to find expected explosion overpressures and missile energies and to decide the reasonably practicable protection required. In general, explosion protection is best achieved by locating the ESD valve well outside congested equipment modules where the explosion over-pressures are known to be highest. ESDVs located immediately outside the openings from congested modules are also susceptible to explosion damage. Whilst this is possible with new designs, it will probably be found that for existing installations the duty holder has provided blast walls to protect the ESDVs from explosion effects. Impact Protection Protection from horizontal impacts may be achieved by blast walls provided for explosion protection. The main impacts to be considered are:
dropped and falling objects; missiles resulting from explosions; and vessels/ships.
169
The operator should carry out a study of the possible impacts, including those which could be experienced following another incident, such as heavy machinery falling from above, and he should assess what protection is necessary. Note, whilst this "protection by design" will be possible for new installations, for existing installations the assessors experience will be necessary in judging the adequacy of protection in place. Some of the protection may be in the form of procedural control, eg for crane handling, boat approach, etc. ESDV Operational Failure The duty holder should assess the risks of the ESD valve failing to operate on demand. This could be anticipated in design by the fitting of a subsea isolation system (SSIS) or otherwise. Actuators and Control Panel The duty holder should describe the type of actuators used on the ESDVs. The ESDV, its actuator, the local control panel, and where fitted, its accumulators and any ESDV dedicated maintenance valves, should be located close together. The location of the local control panel, together with any other measures taken, should facilitate the rapid selection of the correct control panel and should enable the operative to view the valve position indicator during local partial closure tests. The actuator and any stored energy device (eg spring return or accumulator) required for fail-safe close purposes should be protected as part of "the valve and its actuating mechanism". A description of the protection of these items should be included in the safety case. 5. Other Related Assessment Sheets in this Section are: 5.2.HS1 5.2.HS2 6. Rigid Riser Other Risers including Flexible Risers
Cross-Referenced Sections and Sheets are: Section 3 Section 5.1 Section 5.3 Sheet 2.F6 Loss of Structural Integrity Loss of Containment - Process Loss of Containment - Fire and Explosion SBVs, Communications & Procedures
7.
8.
170
5.2.HS5:
Subsea Isolation Systems (SSIS)
[Relevant Sheets: 5.2.G1, 5.2.G2, 5.2.G3, 5.2.G4, 5.2.G6, 5.2.G7, 5.2.G9, 5.2.G10, 5.2.G17, 5.2.G18, 5.2.G20, 5.2.G21, 5.2.G23, 5.2.G24, 5.2.G27, 5.2.G28, 5.2.G29, 5.2.F1, 5.2.F2, 5.2.F3, 5.2.F4, 5.2.F6, 5.2.F7, 5.2.F9, 5.2.F10, 5.2.F11, 5.2.F12, 5.2.F13, 5.2.F14, 5.2.F17, 5.2.F18, 5.2.F19, 5.2.F20, 5.2.F24, 5.2.F26, 5.2.F28, 5.2.F29, 5.2.F30, 5.2.F31, 5.2.F32] 1. An assessment should be carried out for all ESDVs at an installation with particular reference to the definitions of ESD levels and modes of operation and failure of the ESDVs. Confirmation should be obtained that the pipeline operator/duty holder has ensured that the ESDV has been properly designed and constructed and is operated safely to ensure that the ESDV will be in accordance with recognised standards and guidance. These include: API Spec 6D Pipeline Valves ISO 14313 Subsea Pipeline Valves 2. Where a standard/code of practice other than those listed above has been employed, judgement as to the adequacy can only be assessed on an individual basis and the duty holder should be required to justify that the applied standard/code will be equally effective. Relevant Legislation, ACOP and Guidance includes: Pipelines Safety Regulations 1996, in particular Regulations 5-17, 18-24, Schedules 2-5 and associated Guidance Document L82 Offshore Installations (Safety Case) Regulations 2005 and associated Guidance Document L30 Offshore Installations (Prevention of Fire and Explosion, and Emergency Response) Regulations 1995 and associated ACoP and Guidance Document L65 Assessment Principles for Offshore Safety Cases [APOSC], in particular paragraphs 8, 9, 14, 16, 109, 115 Provision and Use of Work Equipment Regulations 1998, in particular Regulations 4, 5 and 12 4. Specific Technical Issues: The duty holder should describe the subsea isolation systems (SSISs) installed. There should be a description with layout giving location, modes of operation, type of valve and actuator and failure modes (eg fail close on loss of hydraulics/signal). The hardware description of an SSIS is not of such great importance. What is more important is having adequate measures taken against hazards from pipelines and risers and if not, and if a SSIS is not fitted, why not? If a SSIS is fitted, how was its location decided? The assessor should acknowledge that subsea isolation valves (SSIVs) are not a mandatory requirement. However, the duty holder is expected in agreement with the Cullen Report and in particular recommendation 44 to ".... demonstrate in the safety case that adequate provision has been made, including if necessary the use of SSIVs, against hazards from risers and pipelines".
3.
171
Due to the location of the subsea isolation systems, significant inventory of hydrocarbons will be present between the subsea valve and the top of the riser. Therefore, failure of the riser or underwater pipeline near the installation will result in an unavoidable discharge of hydrocarbons under pressure, with the potential of serious fire or vapour cloud explosion. A subsea valve cannot prevent this initial discharge from taking place and cannot protect personnel in the open or working in the vicinity of the riser. This can also upset the buoyancy of floating production installations and vessels. In assessing the arguments for/against installing a subsea valve, it is necessary to concentrate on the effect it has upon the consequences of a failure. Particularly so where pipelines are branched into main transportation lines or third-party imports are concerned. Note that in such cases, without a subsea isolation system, there is scope for an unlimited supply of fuel in a fire situation. Although topside ESDVs are required by law for most major accident hazard pipelines, the risk of the ESDV failing to operate on demand should be included in the input to the decision concerning the fitting of an SSIS. Non-return or Check Valves On some risers a non-return valve (NRV) or check-valve may be used as a means of isolation. The NRV has the advantages of being a self-contained operation and of rapid closure in the event of a pipeline rupture. Due to the closure times of actuated valves, there will be some initial hydrocarbon discharge which will last longer than for a non-return valve. One of the disadvantages with NRVs is that an actuated SSIV has the advantage of being closed in the event of a small leak or a fire in the vicinity of the riser, whereas the same cannot be said about non-return valves. They are however, not suitable for all applications - they can be installed on export lines but, by their nature, not on import lines. For export pipelines they may prevent the normal flow being reversed for operational reasons, such as during routine depressurisation. Their presence also makes it more difficult to pig the line, and are liable to be damaged by pigging. The important thing to note is that they will not prevent a small leak (ie may not give a tight seal). Accordingly, the duty holder should give the exact criteria under which their operation and efficiency is expected. Location of SSIS Location studies will normally be carried out where SSISs are to be installed. Subsea valves are usually located some distance away from the installation they are intended to protect. This is necessary to balance the risks due to any possible line failures resulting from objects dropped from the platform, supply boats, or from dragging anchors, fishing hazards, etc. on the platform side of the valve A rupture on the far side of the valve in which case it is necessary to address:
gas cloud or oil pool dispersion; protection of the pipeline; and protection of the SSIS which can itself be an extra leak path.
In some cases an operator will wish to locate a SSIS for ease of construction - examples are floating production installations with riser base valves, flowline bundles which arrive
172
within 50 metres of a fixed platform, SSIS skids serving several pipelines, spool-piece flanges being used to avoid the cost of hyperbaric welds, etc. The pipeline to platform approach layout should be considered carefully to ensure that each SSIS is located on a sound risk balancing basis. Description of SSIS The description must include the modes of closure/operation and the failure modes. Operators are sometimes reluctant to have fail safe close valves in case, during a test or following a spurious failure, it shuts and remains jammed shut. It is however, no use having a SSIS in place which is almost impossible to use or is functionally locked open. There should be fail safe modes of closure or similar in event of loss of hydraulics/other platform signals. The system should include local energy storage (such as a spring or hydraulic accumulator) to close the valve, and it should not rely on platform based hydraulic or other power supply for closure in an emergency. Protection The SSIS should be protected from impact and snag loads from anchor lines and fishing trawls. Usually a structure is provided for this purpose. Inspection, Testing and Maintenance The duty holder should describe the philosophy for carrying out inspection, testing and maintenance on the subsea isolation valves. This should not just be limited to SSIVs NRVs should be addressed as well. As with any safety system, the reliability needs to be assured, and this is normally done by carrying out periodic tests. The duty holder should describe the extent, type and frequency of these tests. There should be detailed procedures in place for this purpose. However, experience indicates that this is not always the case and operators are sometimes afraid of testing in case the valves are damaged or cannot be opened again. Testing should include:

5.
full (and if desired partial) closure; valve seat leak tests; and checks for confirming closure, eg provision of local (visual) valve position indicators as well as the remote system.
Other Related Assessment Sheets in this Section are: 5.2.HS1 5.2.HS2 5.2.HS3 Rigid Riser Other Risers including Flexible Risers Outboard Pipeline
6.
Cross-Referenced Sections and Sheets are: Section 3 Section 4.1 Section 4.2 Section 5.1 Loss of Structural Integrity Loss of Maritime Integrity - Loss of Stability Loss of Maritime Integrity - Loss of Position Loss of Containment - Process
173
Sheet 2.F6 7.
SBVs, Communications & Procedures
8.
174
5.2.HS6:
Pig Traps
[Relevant Sheets: 5.2.G1, 5.2.G2, 5.2.G3, 5.2.G4, 5.2.G5, 5.2.G6, 5.2.G7, 5.2.G8, 5.2.G9, 5.2.G10, 5.2.G17, 5.2.G19, 5.2.G20, 5.2.G21, 5.2.G23, 5.2.G24, 5.2.G25, 5.2.G26, 5.2.G27, 5.2.G30, 5.2.F1, 5.2.F2, 5.2.F3, 5.2.F4, 5.2.F6, 5.2.F7, 5.2.F9, 5.2.F10, 5.2.F11, 5.2.F12, 5.2.F13, 5.2.F14, 5.2.F15, 5.2.F20, 5.2.F23, 5.2.F24, 5.2.F25, 5.2.F27, 5.2.F29, 5.2.F30, 5.2.F31, 5.2.F32] 1. Confirmation should be obtained that the pipeline operator/duty holder has ensured that the pig trap (including sphere launchers and receivers) has been properly designed and constructed and is operated safely to ensure that the pig trap/ sphere launcher/receiver will be in accordance with recognised standards and guidance. These include: BS 4515-1 Specification for the Welding of Steel Pipelines on Land and Offshore Part 1: Carbon and Carbon Manganese Steel Pipelines ISO 13847 Pipeline Welding ISO 15590 Part 2 Fittings ISO 15590 Part 3 Flanges ISO 3183 Parts 1 & 2 Linepipe 2. Where a standard/code of practice other than those listed above has been employed, judgement as to the adequacy only be assessed on an individual basis and the duty holder should be required to justify that the applied standard/code will be equally effective. Relevant Legislation, ACOP and Guidance includes: Pipelines Safety Regulations 1996, in particular Regulations 5-17, 18-24, Schedules 2-5 and associated Guidance Document L82 Offshore Installations (Safety Case) Regulations 2005 and associated Guidance Document L30 Offshore Installations (Prevention of Fire and Explosion, and Emergency Response) Regulations 1995) and associated ACoP and Guidance Document L65 Assessment Principles for Offshore Safety Cases [APOSC], in particular paragraphs 8, 9, 14 and 16 Provision and Use of Work Equipment Regulations 1998, in particular Regulations 4, 5 and 12 4. Specific Technical Issues: Ensure that pig trap loading hatches are facing outboard and that adequate protection is afforded against accidental opening of the hatches whilst under pressure. There should be a description of the pigging facilities including closure design, detail on all safety features such as double blocking method, interlocks etc. Bad maintenance and material defects have led to failure of pig trap closures, resulting in substantial damage to pipework and other platform facilities. Incorrect maintenance of a pig signaller has led to an uncontrolled release of gas. 5. Other Related Assessment Sheets in this Section are:
3.
175
5.2.HS1 5.2.HS2 6.
Rigid Riser Other Risers including Flexible Risers
Cross-Referenced Sections and Sheets are: Section 5.1 Section 5.3 Sheet 2.F6 Loss of Containment - Process Loss of Containment - Fire and Explosion SBVs, Communications & Procedures
7.
8.
176
Annex 1 REFERENCE DOCUMENTS A list of references is provided in each assessment sheet. The documents listed below provide guidance for pipeline systems in general, particularly in relation to good practice and performance standards. However, in some cases the reference material will not be fully applicable and may be limited in some parts. Standards and Codes of Practice BS EN 14161:2003 Petroleum and Natural Gas Industries - Pipeline Transportation Systems BS PD 8010 Part 2:2004 Code of Practice for Pipelines. Part 2: Subsea Pipelines Institute of Petroleum Model Code of Safe Practice Part 6 Pipelines DNV Offshore Standard DNV-OS-F101 Submarine Pipeline Systems January 2003 ISO 13623 Pipeline Transportation Systems (but see BS EN 14161) ISO 16708 Reliability Based Limit State Methods ANSI/NACE Std MR0175-2002 Sulphide Stress Cracking Resistant Metallic Materials for Oilfield Equipment API RP 14C Recommended Practice for Analysis, Design, Installation and Testing of Basic Surface Safety Systems for Offshore Production Platforms 7th Edition March 2001 OIAC The Safe Isolation of Plant & Equipment Other guidance and sources of information HSE/IP/UKOOA PARLOC 2001: The Update of Loss of Containment Data for Offshore Pipelines 5th Edition OSD Hydrocarbon Release Database Department of Energy Submarine Pipelines Guidance Notes SPC/TECH/GEN/18 Underlagging Corrosion of Plant & Pipework Offshore Safety Notice 2/00 Bolting of Flanged Joints for Pressurised Systems Institute of Petroleum Guide to the Design of Relief and Blowdown Systems UKOOA/IP Guidelines for the Management of Integrity of Bolted Pipe Joints UKOOA/IP Guidelines for the Management, Design, Installation and Maintenance of Smallbore Tubing Systems UKOOA Guidelines for Instrument Based Protection Systems Rev 2 1999 Report 2003 3135 Project Guidelines for Engineering Critical Assessment for Pipeline Installation Methods Introducing Cyclic Plastic Strain.
177
5.3 LOSS OF CONTAINMENT FIRE & EXPLOSION

1. Scope This Section provides guidance for the assessment of safety case content with respect to the loss of containment from process plant and process operations, leading to fires and explosion. The assessment procedure includes hazard identification, consequence determination and risk management measures. 2. Assessment of Adequacy of Demonstration The evaluation of risk that might stem from each major accident hazard is to be assessed by identification of the factors that might result in an adverse combination of a source of hazard and initiator, together with identification and evaluation of escalation paths that might result. Potential sources of hazard, initiators, etc, are shown in the document. Assessors should ensure that, where relevant, safety cases contain information demonstrating that consideration has been given to each of these factors 3. Depth of Assessment This section gives guidance on the depth of assessment required to determine the adequacy of the demonstration that measures have been or will be taken to ensure compliance with the relevant statutory provisions. Where safety case contents match with good practice identified in the assessment sheets for a particular element associated with a major accident, there will usually be no need for an assessor to probe into the details of how the good practice is applied. This may, however, be a suitable issue for follow-up by inspection.
178
Loss of Containment - Fire & Explosion Source of Hazard
Loss of Containment
Initiators
Ignition F1
Risk Evaluation
Frequency Ignition Probability *Ignition sources/Ex rating/ Electrical Zoning F2 F3 F4 Hot and cold work policies Delayed or Immediate Ignition Energy of Ignition Consequences F13 F14 F15 F16 F17 F18 F19

Inherent Safety Intrinsically Safe Electrical Equipment Separate Accommodation Jacket Risers & Topsides Pressure Rating Fully Rated Structure Normally Unmanned Installations (NUI) Fully Welded Topside Pipework in Critical Areas Layout No jet fire Targets
Fire resistant structures Inventory size Fire load limits Impact loads Impact protection Containment strength Material specification Low risk location
F5
Release Size, Detection, Shutdown Effectiveness Prevention F20 F21 F22 Hazardous Areas Electrical Equipment for Use in Potentially Flammable Atmospheres PTW
Certification schemes
F6
Cloud size, Dispersion Conditions/ Ventilation
F7
Escalation, Layout, Separation, Open/Closed Modules
F8
Fire Types
Detection
179
Loss of Containment - Fire & Explosion Source of Hazard Initiators

F9
Risk Evaluation
Thermal Flux, Smoke Obscuration Effects F10 F11 F12 Fire Modelling Explosion Modelling Near and Far Field Effects F24 F25 F26 F27 F28 F29 F30 F23

Mitigation Firewalls Passive Fire Protection [PFP] Resistant Temporary Refuges Deluge & Sprinklers Ventilation and HVAC Blast Walls Suppression and Flame Arrestors
180
5.3.F1:
1.
Ignition Probability
There are no agreed recognised standards or codes of practice for confirming that the probability of ignition has been derived from information relevant to the installation design and operational intent, see Section 3 below. Judgement as to the adequacy of the ignition probability assessment can only be assessed on an individual basis and the duty holder should be required to justify why its procedures/practices in the relevant areas will deliver an equivalent level of health and safety performance. Relevant Legislation, ACOP and Guidance includes: Offshore Installations (Safety Case) Regulations 2005 Offshore Installations (Prevention of Fire and Explosion, and Emergency Response) Regulations 1995 Fire & Explosion Strategy Document, HSE website 2004 Fire & Explosion and Risk Assessment Topic Guidance, HSE website 2003
2.
3.
4.
5.
6.
7.
8.
181
5.3.F3:
1.
Delayed or Immediate Ignition
There are no agreed recognised standards or codes of practice for the assessment of delayed or immediate ignition. Analysis of the timing of ignition of a gas releases is important in determining the explosion risk. Early ignition will tend to give rise to a jet fire. Delayed ignition can cause an explosion or flash fire, depending on the degree of confinement.
2.
Judgement as to the adequacy of the analysis of delayed or immediate ignition can only be assessed on an individual basis, and the duty holder should be required to justify why its procedures/practices in the relevant areas will deliver an equivalent level of health and safety performance. Relevant Legislation, ACOP and Guidance includes: Offshore Installations (Safety Case) Regulations 2005 Offshore Installations (Prevention of Fire and Explosion, and Emergency Response) Regulations 1995 Fire, Explosion & Risk Assessment Topic Guidance, HSE website 2003 Fire & Explosion Strategy Document, HSE website 2004
3.
Specific Technical Issues: 4.1 The safety case should provide evidence that techniques such as event tree analysis or an equivalent approach has been used to assess consequences of immediate or delayed ignition. 4.2 The basis for calculation of delayed or immediate ignition used in the event trees should be justified on the basis of ignition probability models used. 4.3 Models should to take account of factors including the leak duration, type and dimensions of module, ventilation rate and types of ignition sources which are present 5. Other Related Assessment Sheets in this Section are: 5.3.F23 6. Fire/Smoke/Gas/Flame Detectors/Alarms
Cross-Referenced Sections and Sheets are: Section 5.1 Sheet 5.1.F12 Loss of Containment - Process Dispersion, Open or Closed Modules, Ventilation Rates
182
7.
8.
183
5.3.F7:
1.
Escalation, Layout, Separation, Open/Closed Modules
Confirmation should be obtained that escalation, layout, separation, open/closed modules have been designed, constructed and analysed in accordance with a recognised standard or code of practice. Recognised standards/codes of practice would include: ISO/FDIS 13702 Petroleum and Natural Gas Industries Control & Mitigation of Fires and Explosions on Offshore Production Installations: Requirements and Guidelines Escalation of a fire or explosion incident will be dependant on installation layout, separation of hazardous and safe areas, and module type. Escalation risk will be primarily focussed on TR impairment and escape/evacuation risks rather than individual risk to personnel working on the plant or involved in drilling etc.
2.
Where a standard/code of practice other than those listed above has been employed, judgement as to the adequacy of the design for escalation, layout, separation and open/closed modules can only be assessed on an individual basis, and the duty holder should be required to justify why its procedures/ practices in the relevant areas will deliver an equivalent level of health and safety performance. Relevant Legislation, ACOP and Guidance includes: Offshore Installations (Safety Case) Regulations 2005 Offshore Installations (Prevention of Fire and Explosion, and Emergency Response) Regulations 1995 Fire, Explosion & Risk Assessment Topic Guidance, HSE website 2003 Fire & Explosion Strategy Document, HSE website 2004 UKOOA/HSE Fire & Explosion Guidance Part 0: Fire & Explosion Hazard Management, October 2003 UKOOA/HSE Fire & Explosion Guidance Part 1: Avoidance & Mitigation of Explosions, October 2003
3.
Specific Technical Issues: 4.1 Evidence should be provided to demonstrate that wherever possible large hydrocarbon inventories have been separated and isolation is provided between them such that escalation risk between them has been minimised. 4.2 It should be demonstrated that both immediate and delayed escalation has been considered. 4.3 Evidence should be provided that the HAZID process has been thorough and consideration of escalation from relatively small scale initiating incidents has been included. 5. Other Related Assessment Sheets in this Section are: 5.3.F5 5.3.F6 5.3.F8 6. Release Size, Detection, Shutdown Effectiveness Cloud Size, Dispersion Conditions/Ventilation Fire Types
184
Section 5.1 7.
Loss of Containment - Process
8.
185
5.3.F8:
1. 2.
Fire Types
There are no agreed recognised standards or codes of practice for confirming that all reasonably foreseeable fire types have been identified and assessed. Judgement as to the adequacy of the identification and characterisation of fire types can only be assessed on an individual basis, and the duty holder should be required to justify why its procedures/practices in the relevant areas will deliver an equivalent level of health and safety performance. Relevant Legislation, ACOP and Guidance includes: Offshore Installations (Safety Case) Regulations 2005 Offshore Installations (Prevention of Fire and Explosion, and Emergency Response) Regulations 1995 Fire, Explosion & Risk Assessment Topic Guidance, HSE website 2003 Fire & Explosion Strategy Document, HSE website 2004
3.
4.
5.
Other Related Assessment Sheets in this Section are: 5.3.F9 5.3.F10 Thermal Flux, Smoke Obscuration Effects Fire Modelling
6.
7.
8.
186
5.3.F9:
1.
Thermal Flux, Smoke Obscuration Effects
There are no agreed recognised standards or codes of practice for confirming that due consideration has been given to the determination of appropriate levels of thermal flux and smoke obscuration effects within a consequence assessment, see Section 3 below. Judgement as to the adequacy can only be assessed on an individual basis, and the duty holder should be required to justify why its procedures/practices in the relevant areas will deliver an equivalent level of health and safety performance. Relevant Legislation, ACOP and Guidance includes: Offshore Installations (Safety Case) Regulations 2005 Offshore Installations (Prevention of Fire and Explosion, and Emergency Response) Regulations 1995 Fire, Explosion & Risk Assessment Topic Guidance, HSE website 2003 Fire & Explosion Strategy Document, HSE website 2004 OSD SPC Human Vulnerability Criteria for Use in Hazard and Risk Assessment for the Offshore Industry [under development]
2.
3.
4.
5.
6.
7.
8.
187
5.3.F10:
1. 2.
Fire Modelling
There are no agreed recognised standards or codes of practice for assessing the modelling of fires. Judgement as to the adequacy of the fire modelling assessment can only be assessed on an individual basis, and the duty holder should be required to justify why its procedures/practices in the relevant areas will deliver an equivalent level of health and safety performance. Relevant Legislation, ACOP and Guidance includes: Offshore Installations (Safety Case) Regulations 2005 Offshore Installations (Prevention of Fire and Explosion, and Emergency Response) Regulations 1995 Fire, Explosion & Risk Assessment Topic Guidance, HSE website 2003 Fire & Explosion Strategy Document, HSE website 2004
3.
4.
Specific Technical Issues: 4.1. There are major uncertainties in modelling the behaviour and properties of fires of condensate and higher molecular weight hydrocarbons, multi-component materials, and liquids released from pressurised containment. 4.2 Evaluating very large flames of all materials, and the behaviour of running fires also require careful consideration, as the fire characterisation parameters may exceed the models capability. 4.3 The influence of water deluge and foam on fuel distribution should be considered separately as part of fire mitigation.
5.
Other Related Assessment Sheets in this Section are: 5.3.F8 5.3.F9 Fire Types Thermal Flux, Smoke Obscuration Effects
6.
7.
8.
188
5.3.F11:
1.
Explosion Modelling
Confirmation should be obtained that explosion modelling has been analysed in accordance with a recognised standard or code of practice. Recognised standards/codes of practice would include: ISO/FDIS 13702Petroleum and Natural Gas Industries Control and Mitigation of Fires & Explosions on Offshore Production Installations: Requirements & Guidelines Explosion modelling for offshore structures is required to quantify the risk of immediate or delayed escalation. Phenomenological modelling can provide an acceptable level of accuracy provided that appropriate gas dispersion modelling is carried out to give a representation of gas cloud size. CFD modelling may provide the highest degree of accuracy provided appropriate gas cloud modelling is carried out.
2.
Where a standard/code of practice other than those listed above has been employed, judgement as to the adequacy of the explosion modelling can only be assessed on an individual basis, and the duty holder should be required to justify why its procedures/practices in the relevant areas will deliver an equivalent level of health and safety performance. Relevant Legislation, ACOP and Guidance includes: Offshore Installations (Safety Case) Regulations 2005 Offshore Installations (Prevention of Fire and Explosion, and Emergency Response) Regulations 1995 Fire, Explosion & Risk Assessment Topic Guidance, HSE website 2003 Fire & Explosion Strategy Document, HSE website 2004 UKOOA/HSE Fire & Explosion Guidance Part 0: Fire & Explosion Hazard Management October 2003 UKOOA/HSE Fire & Explosion Guidance Part 1: Avoidance and Mitigation of Explosions October 2003
3.
4.
Specific Technical Issues: The explosions analysis should explain what type (average, average peak or peak) of overpressure has been calculated and how it has been used in the analysis of effects on blast walls, fixings, structures, decks and roofs, plant and equipment.
5.
Other Related Assessment Sheets in this Section are: 5.3.F3 5.3.F7 Delayed or Immediate Ignition Escalation, Layout, Separation, Open/Closed Modules
6.
Cross-Referenced Sections and Sheets are: Section 5.1 Loss of Containment Process
Sheet 5.1.F11 Size of Release, Speed of Detection and Effectiveness 7. Lead Assessment Section for this Sheet: OSD3.2
189
8.
190
5.3.F13:
1.
Intrinsically Safe Electrical Equipment
Confirmation should be obtained that intrinsically safe electrical apparatus has been designed and is maintained to recognised standards/codes of practice appropriate to the nature of the flammable atmosphere that the apparatus may encounter and the category of hazardous area zone where the apparatus will be located/operated. Appropriate CE marking with respect to the Atex Directive is one way of indicating that the design is to a recognised standard [See 5.3.F21 Electrical Equipment for Use in Potentially Flammable Atmospheres]. Design Standards for Intrinsically Safe Apparatus Include: BSEN50020 Electrical apparatus for potentially explosive atmospheres. Intrinsic safety i and; IEC60079-11 [BSEN60079-25] Electrical apparatus for explosive gas atmospheres. Part 11: Intrinsic safety Standards for Selection of Intrinsically Safe Apparatus Include: BSEN60079-14 [IEC60079-14] Electrical apparatus for explosive gas atmospheres. Electrical installations in hazardous areas (other than mines) Standards for Inspection/Maintenance of Ex Equipment Include: BSEN0079-17 [IEC60079-17] Electrical apparatus for explosive gas atmospheres. Inspection and maintenance of electrical installations in hazardous areas (other than mines) and; BS5345 Code of practice for selection, installation and maintenance of electrical apparatus for use in potentially explosive atmospheres (other than mining applications or explosive processing and manufacture) [now superseded]. Intrinsic safety is a type of protection for electrical apparatus to be used in potentially flammable atmospheres. The mechanism by which intrinsic safety protection is achieved is the restriction of electrical [and electromagnetic] energy within apparatus and interconnected wiring to a level which cannot cause ignition by sparking or heating. Intrinsically safe equipment is designated Exi.
2.
Where a standard/code of practice other than those listed above has been employed, judgement as to the adequacy of the electrical equipment and its maintenance regime can only be assessed on an individual basis. In these cases the duty holder should be required to justify why the methods employed will result in an equivalent level of safety to that required in the referenced standards. Relevant Legislation, ACOP and Guidance includes: Electricity at Work Regulations 1989, Regulations 4 and 6: Memorandum of Guidance on EAWR Regulation 6, paras 14-19 Offshore Installations (Prevention of Fire and Explosion, and Emergency Response) Regulations 1995, Regulation 9(2)(d) Provision and Use of Work Equipment Regulations 1998, Regulation 4 Equipment and Protective Systems for Use in Potentially Explosive Atmospheres Regulations [Not applicable to MODUs, FPSOs and FSUs].
3.
191
4.
Specific Technical Issues: 4.1 Intrinsically safe electrical equipment is divided into two further categories Exia and Exib. An Exib circuit must remain non-incendive in normal operation and operation with one fault. An Exia circuit must remain non-incendive in normal operation and operation with two faults. Some of the mechanisms employed to achieve intrinsic safety rely on the operation of active components [eg Zener diode barriers in a safe area] to restrict the flow of energy into the apparatus. Other mechanisms for achieving intrinsic safety include procedural elements [eg apparatus should not be opened in a hazardous area]. Thus even within electrical equipment designated intrinsically safe there can be significant variation in the degree to which the equipment corresponds to the concept of inherently safer. 4.2 Exia certification is the only standard type of certification allowed for electrical equipment which is intended for use in Zone 0 atmospheres. 4.3 Many electrical functions cannot readily be implemented using the intrinsically safe concept [eg trace heating, motors]. 4.4 Where risk of electrical ignition is a key determinant of risk for the installation [eg congested modules near TR] then the duty holder should examine the extent to which protection against incendivity of electrical equipment using Exia intrinsically safe techniques is a reasonably practicable option.
5.
Other Related Assessment Sheets in this Section are: 5.3.F20 5.3.F21 Hazardous Area Zoning Electrical Equipment for Use in Potentially Flammable Atmospheres
6.
7.
8.
192
5.3.F14:
1.
Separate Accommodation Jacket
One of the most obvious and inherently safer means of protecting personnel on offshore installations from fire and explosion hazards is to provide a separate accommodation jacket removed from but connected to [normally by bridge link] the main hazardous activity centres of drilling and hydrocarbon production. This concept of two separate bridge linked jackets has been incorporated into a number of recent new designs [eg Shearwater, Buzzard] as well as modifications to existing platforms [eg Claymore]. Whilst the selection between different design options ultimately lies with the duty holder, confirmation should be obtained that provision of a separate accommodation jacket was considered as a design option for all new facilities. Provision of a separate accommodation jacket should also have been examined as a potential risk reduction remedial measure for existing installations.
2.
Where a standard/code of practice other than those listed above has been employed, judgement as to the adequacy of the design options considered can only be assessed on an individual basis. In these cases the duty holder should be required to justify why the methods employed will result in an equivalent level of safety to that required in the referenced standards. Relevant Legislation, ACOP and Guidance includes: Management of Health and Safety at Work Regulations 1999, ACOP para 27 Assessment Principles for Offshore Safety Cases [APOSC], paras 956 and 98
3.
4.
5.
6.
Cross-Referenced Sections and Sheets are: 5.1.F10 5.1.F14 Concept Selection Inherent Safety
7.
8.
193
5.3.F17:
1.
Normally Unmanned Installations (NUI)
Confirmation should be obtained that requirements for fire and explosion hazards have been analysed in accordance with recognised standards or codes of practice that would be used for a manned Installation. Recognised standards/codes of practice would include: ISO/FDIS 13702 Petroleum and Natural Gas Industries Control and Mitigation of Fires & Explosions on Offshore Production Installations: Requirements and Guidelines
2.
Where a standard/code of practice other than those listed above has been employed, judgement as to the adequacy of the evaluation of these hazards can an only be assessed on an individual basis, and the duty holder should be required to justify why its procedures/practices in the relevant areas will deliver an equivalent level of health and safety performance. Relevant Legislation, ACOP and Guidance includes: Offshore Installations (Safety Case) Regulations 2005 Offshore Installations (Prevention of Fire and Explosion, and Emergency Response) Regulations 1995 Fire, Explosion & Risk Assessment Topic Guidance, HSE website 2003 Fire & Explosion Strategy Document, HSE website 2004
3.
4.
Specific Technical Issues: Specific attention should be paid to the Installation status to ensure that plant and equipment is in a safe state prior to a planned visit such that persons are not entering a hazardous environment.
5.
Other Related Assessment Sheets in this Section are: 5.3.F8 5.3.F10 5.3.F11 5.3.F28 Fire Types Fire Modelling Explosion Modelling Ventilation and HVAC
6.
Cross-Referenced Sections and Sheets are: Section 5.1 Loss of Containment - Process
7.
8.
194
5.3.F19:
1.
Layout No Jet Fire Targets
Confirmation should be obtained that the installations layout for jet fire mitigation has been analysed in accordance with recognised standards or codes of practice. Recognised standards/codes of practice would include: ISO/FDIS 13702 Petroleum and Natural Gas Industries Control and Mitigation of Fires & Explosions on Offshore Production Installations: Requirements and Guidelines
2.
Where a standard/code of practice other than those listed above has been employed, judgement as to the adequacy of the layout for jet fire mitigation can only be assessed on an individual basis, and the duty holder should be required to justify why its procedures/practices in the relevant areas will deliver an equivalent level of health and safety performance. Relevant Legislation, ACOP and Guidance includes: Offshore Installations (Safety Case) Regulations 2005 Offshore Installations (Prevention of Fire and Explosion, and Emergency Response) Regulations 1995 Fire, Explosion & Risk Assessment Topic Guidance, HSE website 2003 Fire & Explosion Strategy Document, HSE website 2004
3.
4.
Specific Technical Issues: 4.1 Wherever possible redundant plant should be removed to minimise potential targets for incident jet fires. 4.2 Process plant including pipework, vessels cable tray etc should, as far as possible, be oriented to minimise targets for potential jet fires or protection provided to absorb jet fire momentum and thermal flux.
5.
Other Related Assessment Sheets in this Section are: 5.3.F7 5.3.F9 5.3.F10 5.3.F28 Escalation, Layout, Separation, Open/Closed Modules Thermal Flux, Smoke Obscuration Effects Fire Modelling Ventilation and HVAC
6.
7.
8.
195
5.3.F20:
1.
Hazardous Area Zoning
Confirmation should be obtained that hazardous area zoning of plant is based on the likelihood that a flammable atmosphere may arise in the area. Recognised standards/codes of practice would include: BSEN60079-10 [IEC60079-10] Electrical Apparatus for Explosive Gas Atmospheres. Classification of Hazardous Areas Institute of Petroleum Model Codes of Safe Practice in the Petroleum Industry. Part 15: Area Classification Code for Installations Handling Flammable Fluids IEC 61892-7 Mobile and Fixed Offshore Units Electrical Installations Hazardous Areas API-RP500B Recommended Practice for Classification of Locations for Electrical Installations at Petroleum Facilities Classified as Class 1, Division 1 and Division 2
2.
Where a standard other than those listed above has been employed, judgement as to the adequacy can only be made on an individual basis and the duty holder should be required to justify why the methods employed will result in an equivalent level of safety to those required by the referenced standards. Relevant Legislation, ACOP and Guidance includes: Equipment and Protective Systems for Use in Potentially Explosive Atmospheres Regulations [not applicable to MODUs, FPSOs and FSUs] Electricity at Work Regulations 1989, Regulation 6 Offshore Installations (Prevention of Fire and Explosion, and Emergency Response) Regulations 1995, Regulation 9 Provision and Use of Work Equipment Regulations 1998, Regulation 10 [Atex aspects not applicable to MODUs, FPSOs and FSUs]
3.
4.
Specific Technical Issues: 4.1 Zones may change depending on activity [eg drilling or the presence of another installation during a combined operation]. 4.2 Zoning may depend on forced ventilation. If ventilation fails then equipment not suitable for use in the reduced ventilation zone should be de-energised.
5.
Other Related Assessment Sheets in this Section are: 5.3.F13 5.3.F21 Intrinsically Safe Electrical Equipment Electrical Equipment for Use in Potentially Flammable Atmospheres
6.
7.
8.
196
5.3.F21:
Electrical Equipment for Use in Potentially Flammable Atmospheres
Introduction Electrical equipment can cause ignition of flammable atmospheres either by sparking or by temperature effects. Suitable equipment [whether or not it predates the requirements of the Atex 95 Directive] is usually marked with an Ex symbol and this has led to the colloquial designation Ex equipment. Sources of electromagnetic radiation [eg aerials] can also cause ignition of flammable atmospheres whether or not the radiation source is located in a hazardous atmosphere 1. Confirmation should be obtained that electrical equipment in potentially flammable atmospheres has been designed selected and maintained with a recognised industry standard or code of practice. Recognised design standards for electrical equipment for use in potentially flammable atmospheres include: The harmonised standards under the Atex 95 Directive. The European Atex 95 Directive requires new equipment in hazardous areas from July 2003 on fixed installations to be suitably CE marked. Details of harmonised standards under Atex 95 are issued in the European Union Journal. A summary of the relevant harmonised standards is given at http://europa.eu.int/comm/enterprise/newapproach/standardization/harmstds/reflist/atex.ht ml IEC60079 Electrical Apparatus for Explosive Gas Atmospheres. Parts of this are almost identical to the corresponding CENELEC standards identified above. BS5345 Code of Practice for the Selection, Installation and Maintenance of Electrical Apparatus for Use in Potentially Explosive Atmospheres [no longer current] Recognised standards for selection of electrical equipment for use in potentially flammable atmospheres include: BSEN60079-14 (IEC60079-14) Electrical Apparatus for Explosive Gas Atmospheres Recognised standards for inspection and maintenance of electrical equipment for use in potentially flammable atmospheres include: BSEN60079-17 (IEC60079-17) Electrical Apparatus for Explosive Gas Atmospheres BS5345 Code of Practice for the Selection, Installation and Maintenance of Electrical Apparatus for Use in Potentially Explosive Atmospheres (no longer current). The recognised standard for ignition of flammable atmospheres by radio frequency radiation sources include: BS6656 Guide to Inadvertent Ignition of Flammable Atmospheres by Radio Frequency Radiation 2. Where a standard/code of practice other than those listed above has been employed, judgement as to the adequacy of the management of electrical equipment for hazardous areas can only be assessed on an individual basis. In these cases the duty holder should be required to justify why the methods employed will result in an equivalent level of safety to that required in the referenced standards. Relevant Legislation, ACOP and Guidance includes:
3.
197
Equipment and Protective Systems for Use in Potentially Explosive Atmospheres Regulations 1996 [not applicable to MODUs, FPSOs and FSUs] Electricity at Work Regulations 1989, Regulation 6 Offshore Installations (Prevention of Fire and Explosion, and Emergency Response) Regulations 1995, Regulation 9 Provision and Use of Work Equipment Regulations 1998, Regulation 10 [Not applicable to MODUs, FPSOs and FSUs] 4. Specific Technical Issues: 4.1 A typical installation may contain several thousand items of electrical apparatus for use in potentially flammable atmospheres. In the vast majority of cases it is unlikely that safety case assessment would require evidence of electrical protection for specific items of apparatus. It is normally evidence of the general approach that is being sought and assessed. 4.2 Where deluge is automatically triggered by detection of gas the suitability of electrical equipment in the relevant area should be subject to detailed assessment. 4.3 Where equipment acts as a source of high power electromagnetic radiation [eg Radar] then the duty holder should have assessed the risk that ignition of flammable atmospheres could be caused by induced currents in local metallic structures. In general unless the sources of radio frequency radiation are very powerful it is unlikely they will be a significant contributor to the risk of ignition. 5. Other Related Assessment Sheets in this Section are: 5.3.F13 5.3.F20 6. Intrinsically Safe Electrical Equipment Hazardous Area Zoning
7.
8.
198
5.3.F23
1.
Confirmation should be obtained that fire, smoke and gas detection and alarm systems have been designed and assessed in accordance with a recognised standard or code of practice. Recognised standards/codes of practice would include: ISO/FDIS 13702: 1998E Petroleum and Natural Gas Industries Control and Mitigation of Fires & Explosion on Offshore Production Platforms Requirements and Guidelines BS EN 60079-10: 1996 Electrical Apparatus for Explosive Gas Atmospheres, Part 10, Classification of Hazardous Areas IP [2002] Model Code of Safe Practice for the Petroleum Industry: Part 15 Model Code of Safe Practice Part 15: Area Classification Code for Installations Handling Flammable Fluids, Institute of Petroleum 2nd Edition August 2002
2.
Where a standard/code of practice other than those listed above has been employed, judgement as to the adequacy can only be assessed on an individual basis. In these cases the duty holder should be required to justify why its procedures/practices in the relevant areas will deliver an equivalent level of performance. Relevant Legislation, ACOP and Guidance includes: Offshore Installations (Safety Case) Regulations 2005 Offshore Installations (Prevention of Fire and Explosion, and Emergency Response) Regulations 1995 Fire and Explosion Strategy, HSE website 2004 Fire, Explosion and Risk Assessment Topic Guidance, HSE website 2003
3.
4.
5.
Other Related Assessment Sheets in this Section are: 5.3.F26 Resistant Temporary Refuges
6.
Cross-Referenced Sections and Sheets are: Sheet 10.F3 Temporary Refuge and Muster Stations
7.
8.
199
5.3.F24
1.
Firewalls
Confirmation should be obtained that firewalls have been designed, constructed and maintained in accordance with a recognised standard or code of practice. This would typically be provided by adequate certification that the firewall had satisfied a suitable fire test. Recognised standards/codes of practice would include: BS 476 [Parts 20, 21 and 22] fire tests on building materials and structures BS 6336 1982 Guide to the development and presentation of fire tests and their use in hazard assessment BS 5950 Part 8: 1990 Structural use of steelwork in building: Code of practice for fire resistant design ISO 834 1999 Fire resistance test elements of building construction ISO 13702 1999 Control & mitigation of fires & explosions on offshore production installations IMO [2001] Code for the construction and equipment of mobile offshore drilling units consolidated ASTM E-119 Fire Tests of Building Materials
2.
Where a standard/code of practice other than those listed above has been employed, judgement as to the adequacy can only be assessed on an individual basis, and the duty holder should be required to justify why its procedures/practices in the relevant areas will deliver an equivalent level of health and safety performance. Relevant Legislation, ACOP and Guidance includes: Offshore Installations (Safety Case) Regulations 2005 Offshore Installations (Prevention of Fire and Explosion, and Emergency Response) Regulations 1995 Fire and Explosion Strategy, HSE website 2004 Fire, Explosion and Risk Assessment Topic Guidance, HSE website 2003
3.
4.
5.
6.
7.
8.
200
5.3.F25
1.
Passive Fire Protection [PFP]
Confirmation should be obtained that passive fire protection [PFP] has been designed and constructed in accordance with a recognised standard or code of practice. Recognised standards/codes of practice would include: BS 476 [parts 20, 21 and 22] Fire tests on building materials and structures ISO 2003 Determination of resistance to jet fires of passive fire protection materials BS EN13381 2002 Test methods for the determining the contribution to the fire resistance of structural members ISO 834 1999 Fire resistance test - elements of building construction ISO 13702 1999 Control and mitigation of fires and explosions on offshore production installations
2.
Where a standard/code of practice other than those listed above has been employed, judgement as to the adequacy can only be assessed on an individual basis, and the duty holder should be required to justify why its procedures/practices in the relevant areas will deliver an equivalent level of health and safety performance. Relevant Legislation, ACOP and Guidance includes: Offshore Installations (Safety Case) Regulations 2005 Offshore Installations (Prevention of Fire and Explosion, and Emergency Response) Regulations 1995 Fire and Explosion strategy, HSE website 2004 Fire, Explosion and risk assessment Topic Guidance, HSE website 2003
3.
4.
5.
6.
7.
8.
201
5.3.F26
1.
Resistant Temporary Refuges
Confirmation should be obtained that the temporary refuge [TR] performance has been designed and assessed in accordance with a recognised standard or code of practice. Recognised standards/codes of practice would include: ISO/FDIS 13702: 1998E Petroleum and Natural Gas industries - Control and Mitigation of Fires and Explosions on Offshore Production Platforms UKOOA/HSE Fire and Explosion Guidance Part 1 Avoidance and Mitigation of Explosions Issue 1 October 2003
2.
Where a standard/code of practice other than those listed above has been employed, judgement as to the adequacy can only be assessed on an individual basis, and the duty holder should be required to justify why its procedures/practices in the relevant areas will deliver an equivalent level of health and safety performance. Relevant Legislation, ACOP and Guidance includes: Offshore Installations (Safety Case) Regulations 2005 Offshore Installations (Prevention of Fire and Explosion, and Emergency Response) Regulations 1995 Fire and Explosion Strategy, HSE website 2004 Fire, Explosion and Risk assessment Topic Guidance, HSE website 2003
3.
4.
Specific Technical Issues: 4.1 Criteria used for the impairment of safety functions due to fire and explosion events which have an endurance time of less than an hour, and/or the risk of breach of the integrity of the TR is greater than one in one thousand per year. 4.2 4.3 4.4 Exceptional circumstances where a TR is not provided. The reliance on manual fire damper shutdown. The need to monitor the environmental conditions inside the TR.
5.
6.
7.
8.
202
5.3.F27
1.
Deluge & Sprinklers
Confirmation should be obtained that water deluge and spray systems have been assessed in accordance with a recognised standard or code of practice. Recognised standards/codes of practice would include: BS EN 13702:1999 Petroleum and Natural gas industries Control and Mitigation of Fires and Explosions on Offshore Production Requirements and Guidelines BS 5839:1988 Fire detection and alarm systems for buildings
2.
Where a standard/code of practice other than those listed above has been employed, judgement as to the adequacy can only be assessed on an individual basis, and the duty holder should be required to justify why its procedures/practices in the relevant areas will deliver an equivalent level of health and safety performance. Relevant Legislation, ACOP and Guidance includes: Offshore Installations (Safety Case) Regulations 2005 Offshore Installations (Prevention of Fire and Explosion, and Emergency Response) Regulations 1995 Fire and Explosion Strategy, HSE website 2004 Fire, Explosion and Risk assessment Topic Guidance, HSE website 2003
3.
4.
Specific Technical Issues: General deluge flow rates should be a minimum of 10 litres/min/m2 for pool fire protection, 20 litres/min/m2 for high pressure leak fires [high thermal output], and 400 litres/min/m2 to protect structural steelwork from impinging jet fires.
5.
6.
7.
8.
203
5.3.F28
1.
Ventilation and HVAC
Confirmation should be obtained that ventilation systems have been designed and assessed in accordance with a recognised standard or code of practice. Ventilation should be derived from the identification and assessment of major accident hazards. Recognised standards/codes of practice would include: ISO/FDIS 13702: 1998E (1998) Petroleum and Natural Gas industries - Control and Mitigation of Fires & Explosions on Offshore Production Platforms - Requirements and Guidelines ISO 15138:2000(E) (2000) Petroleum and Natural Gas Industries - Offshore Production Installations - Heating, Ventilation and Air-conditioning IP (2002) Model Code of Safe Practice for the Petroleum Industry: Part 15 Institute of Petroleum Model Code of Safe Practice Part 15: Area Classification Code for Installations Handling Flammable Fluids, 2nd Ed, August 2002 BSI 5925:1991 Ventilation Principles and Designing for Natural Ventilation
2.
Where a standard/code of practice other than those listed above has been employed, judgement as to the adequacy can only be assessed on an individual basis, and the duty holder should be required to justify why its procedures/practices in the relevant areas will deliver an equivalent level of performance. Relevant Legislation, ACOP and Guidance includes: Offshore Installations (Safety Case) Regulations 2005 Offshore Installations (Prevention of Fire and Explosion, and Emergency Response) Regulations 1995 Fire and Explosion Strategy, HSE website Fire, Explosion and Risk Assessment Topic guidance, HSE website 2003 HSE Offshore Information Sheet 2/2006 Offshore Installations (Safety Case) Regulations 2005 Regulation 12 Demonstrating compliance with the relevant statutory provisions
3.
4.
5.
Other Related Assessment Sheets in this Section are: 5.3.F9 5.3.F23 Thermal Flux, Smoke Obscuration Effects Fire/Smoke/Gas/Flame Detectors/Alarms
6.
Cross-Referenced Sections and Sheets are: Sheet 5.1.F11 Section 9 Section 13 Size of Release, Speed of Detection and Effectiveness Non Process Fires & Explosions QRA
7.
Lead Assessment Section for this Sheet:
204
OSD3.2 8. Team responsible for authoring and updating this sheet: OSD3.2
205
5.3.F29
1.
Blast Walls
Confirmation should be obtained that blast walls for overpressure mitigation have been analysed in accordance with recognised standards or codes of practice. Recognised standards/codes of practice would include: ISO/FDIS 13702 Petroleum and Natural Gas industries - Control and Mitigation of Fires & Explosions on Offshore Production Platforms - Requirements and Guidelines
2.
Where a standard/code of practice other than those listed above has been employed, judgement as to the adequacy the blast wall for overpressure mitigation can only be assessed on an individual basis, and the duty holder should be required to justify why its procedures/practices in the relevant areas will deliver an equivalent level of health and safety performance. Relevant Legislation, ACOP and Guidance includes: Offshore Installations (Safety Case) Regulations 2005 Offshore Installations (Prevention of Fire and Explosion, and Emergency Response) Regulations 1995 Fire and Explosion strategy, HSE website 2004 Fire, Explosion and Risk Assessment Topic Guidance, HSE website 2003
3.
4.
Specific Technical Issues: 4.1. Blast walls should be built to the highest resistance possible within the constraints of CBA and capability of the supporting structure. 4.2. Process plant including pipework, vessels, cable tray, etc, should as far as possible be oriented in line with explosion vent paths to reduce turbulence and blockage and hence overpressure incident on the blast walls.
5.
Other Related Assessment Sheets in this Section are: 5.3.F7 5.3.F11 Escalation, Layout, Separation, Open/Closed Modules Explosion Modelling
6.
7.
8.
206
5.3.F30
1.
Suppression and Flame Arrestors
Confirmation should be obtained that the requirement for flame suppression devices or flame arrestors has been analysed in accordance with recognised standards or codes of practice. Recognised standards/codes of practice would include: EN 12874 Flame arrestors Performance requirements, test methods and limits for use
2.
Where a standard/code of practice other than those listed above has been employed, judgement as to the adequacy the flame arrestor duty and related performance can only be assessed on an individual basis, and the duty holder should be required to justify why its procedures/practices in the relevant areas will deliver an equivalent level of health and safety performance. Relevant Legislation, ACOP and Guidance includes: Offshore Installations (Safety Case) Regulations 2005 Offshore Installations (Prevention of Fire and Explosion, and Emergency Response) Regulations 1995 Fire and Explosion Strategy, HSE website 2004 Fire, Explosion and Risk Assessment Topic Guidance, HSE website2003
3.
4.
Specific Technical Issues: 4.1 Wherever possible flame arrestor devices should be specified as suitable for unstable detonations and not the less onerous stable detonations. 4.2 The Maximum Experimental Safe Gap (MESG) is a property of a specific gas mixture. Installed devices must be designed and built to the most onerous flammable gas mixture an installation will process.
5.
Other Related Assessment Sheets in this Section are: 5.3.F8 5.3.F10 5.3.F11 5.3.F28 Fire Types Fire Modelling Explosion Modelling Ventilation and HVAC
6.
7.
8.
207
6.
1.
WELLS
Scope This Section provides guidance for the assessment of safety case content with respect to wells and well systems, from hazard identification through to consequence determination, including risk management measures.
2.
Assessment of Adequacy of Demonstration The evaluation of risk that might stem from each major accident hazard is to be assessed by identification of the factors that might result in an adverse combination of source hazard and initiator, together with identification and evaluation of escalation paths that might result. The main hazard sources have been identified as follows: Shallow Formations Intermediate Formations Reservoir Introduced Fluids Explosives Radioactive Sources Pressure Vessels Dropped Objects For the latent major accident hazards to be activated towards a major accident, 33 initiators have been identified. These are detailed in the categorisation table below. Guidance and standards exist for the basic design of the well and equipment [although the relevance for a particular well will need to be considered]. A list of relevant guidance is given in Section 4 below. Generally, however, guidance and standards are not available for the assessment of conditions and operational activities. These should be evaluated using the assessors own technical expertise and peer reviewed with other wells inspectors using either the formal peer review system or discussed at the monthly well practices forum. It is envisaged that internal guidance will be developed in the near future at which stage the guidance will be added to this manual. The assessor should examine the adequacy of the hazard identification, risk evaluation and management in conjunction with the contents of the categorisation table below.
208
Wells Source of Hazard
HS1 HS2 HS3 HS4 HS5 HS6 HS7 HS8 Shallow Formations Intermediate Functions Reservoir Introduced Fluids Explosives Radioactive Sources Pressure Vessel Dropped Objects G1 G2 G3 G4 G5 G6 G7 G8 G9 G10 G11 G12 G13 G14
Initiators
Overpressure Underpressure High Temperature Low Temperature Erosion Corrosion Seismic Event Fatigue/Vibration Fire Explosion Inadequate Design Inadequate Specification Inadequate Material Specification Incorrect Installation F2 F3 F4 F5 F6 F7 F8 F9 F1
Risk Evaluation
Frequency Well Specific Hazard Studies - basis of design - HAZID - HAZOP - FMEA Equipment Selection Equipment Layout Corporate Standards Competence Operations Procedure Maintenance Procedure Company/Installation Data Generic Historic Data F24 F25 F23 F16 F17 18 F19 F20 F21 F22

Inherent Safety Fully Rated Equipment Inherent Impact Resistance Wellhead Platform Normally Unmanned Installation Subsea Development Equipment Selection Ex, IS Material Selection Prevention Competent Procedures - operational - maintenance Competent Personnel Pre-operational Tests
Material Specification Containment Capability Competency Schemes Inspection & Monitoring Arrangements Impact Protection Fire Resistant Equipment Inventory Size
209

G15 G16 G17 G18
Initiators
Inadequate Training Inadequate Maintenance Inadequate Supervision Incorrect Maintenance Procedures Incorrect Operational Procedures Incorrect Equipment Mechanical Degradation Structural Failure Thermal Radiation Fishing Gear Snagging Anchor Subsidence Subsidence Violation Weather Extreme Helicopter Collision Ship Collision F12 F13 F14 F15 F11 F10
Risk Evaluation
Concept Selection F26 F27 Consequences Size of Release:

Isolation and PTW Controls Integrity Monitoring - mechanical - electrical
G19 G20 G21 G22 G23 G24 G25 G26 G27 G28 G29 G30
- speed of detection - effectiveness of response Dispersion of Release Toxicity of Release Ignition Source: Mechanical and/or Electrical Escalation
F28 F29
Monitoring and Audit Systems Alarms
Detection F30 F31 Competent Personnel Alarms
210

G31 G32 G33
Initiators
Operator Error Seal Failure Chemicals
Risk Evaluation
211
4.
Standards and Guidance for Equipment Design APE SPEC 16D API 14E API 17B API 6A API BULL 16J API BULL 6AR API BULL 6FA API BULL 6FC F1 API BULL 6FC F2 API RP 16Q API RP 2R API RP 53 API SPEC 10 API SPEC 13A API SPEC 13C API SPEC 14A API SPEC 16A API SPEC 5CT APR RP 5B1 APR RP 5C1 ASME 8 BS 1515 BS 5500 ISO 10405 ISO 10407 ISO 10414 Specification for Control Systems for Drilling Well Control Equipment and Control Systems for Diverter Equipment Recommended Practice for Design and Installation Products Platform Recommended Practice for Flexible Pipe Specification for Wellhead and Xmas Tree Equipment Comparison of Marine Drilling Riser Analysis Recommended Practice for Repair and Remanufacture of Wellhead and Xmas Tree Equipment, First Edition Specification Fire Test for Valves Fire Test for Valve with Automatic Backseats Fire Test for Valve with Automatic Backseats Design, Selection, Operation and Maintenance of Marine Drilling Riser Systems Design, Rating, and Testing of Marine Drilling Riser Characterisation of Exploration and Production Associated Wastes Specification for Materials and Testing for Well Cements Drilling Fluid Materials Recommended Practice for Drilling Fluid Processing Systems Evaluation Subsurface Safety Valve Equipment Specification for Drill Through Equipment Specification for Casing and Tubing Recommended Practice for Gauging and Inspection of Casing, Tubing and Pipeline Threads Recommended practice for care and use on casing and tubing Boiler and Pressure Vessel Code Flanges & their joints bolting Specification of unrefined fusion weld pressure vessels Petroleum and natural gas industries - Care and use of casing and tubing Petroleum and natural gas industries; drilling and production equipment; drill stem design and operating limits Petroleum and natural gas industries - Field testing of drilling fluids Part 1: Water based fluids
212
ISO 10416 ISO 10418 ISO 10423 ISO 10424 ISO 10426 ISO 10427 ISO 10432 ISO 11960 ISO 11961 ISO 13500 ISO 13533 ISO 13534
Petroleum and natural gas industries - Drilling fluids - Laboratory testing Petroleum and natural gas industries - Offshore production installations - Basic surface process safety systems Petroleum and natural gas industries - Drilling and production equipment - Wellhead and Xmas tree equipment Draft Document - Petroleum and natural gas industries - Rotary drilling equipment - Part 1: Specification for rotary drilling equipment Petroleum and natural gas industries - Cements and materials for well cementing - Part 1: Specification Petroleum and natural gas industries - Casing centralisers - Part 1: Bow-spring casing centralisers Petroleum and natural gas industries - Downhole equipment Subsurface safety valve equipment Welded carbon steel gas cylinders; periodic inspection and testing Seamless aluminium alloy gas cylinders; periodic inspection and testing Petroleum and natural gas industries - Drilling fluid materials Specifications and tests Petroleum and natural gas industries - Drilling and production equipment Drill through equipment Petroleum and natural gas industries - Drilling and production equipment - Inspection, maintenance, repair and remanufacture of hoisting equipment Petroleum and natural gas industries - Design and operation of subsea production systems - Part 4: Subsea wellhead and tree equipment Petroleum and natural gas industries - Evaluation and testing of thread compounds for use with casing, tubing and line pipe Corrosion resistant alloy seamless tubes for use as casing, tubing and coupling stock - Technical delivery conditions Control and mitigation of fires and explosions on offshore production installations - Requirements and guidelines Collection and exchange of reliability and maintenance data for equipment Downhole equipment - Packers and bridge plugs Materials for use in H2S containing environments in oil and gas production - Part 1: General principles for selection of cracking resistant materials Offshore production installations - Requirements and guidelines for emergency response
ISO 13628-4
ISO 13678 ISO 13680 ISO 13702 ISO 14224 ISO 14310 ISO 15156
ISO 15544
213
ISO 16070
Downhole equipment - Lock mandrels and landing nipples.
214
7.
1.
DIVING
Scope This Section provides guidance for the assessment of safety case content with respect to diving operations, from hazard identification through to consequence determination, including risk management measures. It covers the major accident hazards of:
the failure of life support systems for diving operations in connection with the installation; the detachment of a diving bell used for such operations; the trapping of a diver in a diving bell or other subsea chamber used for such operations; and any other event arising from a diving operation involving death or serious personal injury to five or more persons on the installation or engaged in any activity in connection with it.
Guidance in relation to the assessment of a collision of a diving support vessel [DSV] is provided in Section 2: Vessel Impact. 2. Assessment of Adequacy of Demonstration The evaluation of risk that might stem from each major accident hazard is to be assessed by identification of the factors that might result in an adverse combination of a source of hazard and initiator [casual chains], together with identification and evaluation of escalation paths that might result [consequence chains]. The diving major accident hazard prompts have been classified as follows:
Diving major accident hazards that are specified in the Safety Case Regulations [ie failure of life support systems, detachment of diving bell and trapping of a diver in a bell or other chamber] Any other event involving death or serious personal injury to five or more persons on the installation or engaged in an activity in connection with it.

3.
Human error Design failure Maintenance failure Procedural failure Positioning failure Collision of bell or chamber with subsea structure Fire or explosion affecting diving operation
Depth of Assessment
215
This section gives guidance on the depth of assessment required to determine the adequacy of the demonstration that measures have been or will be taken to ensure compliance with the relevant statutory provisions. Where safety case contents match with good practice identified in the assessment sheets for a particular element associated with a major accident, there will usually be no need for an assessor to probe into the details of the how the good practice is applied. This may, however, be a suitable issue to follow-up through inspection A list of references is provided in each assessment sheet. It should be noted that a more extensive commentary should be referenced. The documents listed provide further guidance, particularly in relation to good practice and performance standards. In some cases the reference material will not be fully applicable and may be limited in some parts. These aspects are referred to on the assessment sheets.
216
Diving Source of Hazard
HS1 Divers Life Support Equipment Heating system Umbilicals Personal equipment
Initiators
Human Factors [Section 11] G1 Commission G2 Omission G3 Fatigue F1
Risk Evaluation
Likelihood Factors Historic data concept selection Layout design Installation/DSV information Vessel performance procedures Competence [Section 11] F4

Inherent safety National & industry standards SMS: client and contractor Competence [Section 11] client and contractor
DSV Selection Capability Crewing Audit
HS2
Diving bell/basket systems Dive control Bell/basket launch and recovery Diving bell/basket main bell umbilical Subsea habitats.
Design failure G4 G5 G6 Power Failure Mechanical Failure
Project scheduling timeframe Weather
F5
Prevention alternatives to diving operations SIMOPS assessment
Diving plant and equipment Selection Audit
Planned maintenance familiarisation Pressure System Failure [diving personnel with installation & vice versa] Hazard identification G7 G8 G9 Maintenance Failure [HAZOPS client with contractor] Power failure Rescue Mechanical Failure Detection system monitoring Pressure System Failure F6 Dive system and vessel auditing Recovery Escape EER Evacuation
217

HS3 Deck chamber complex Surface compression chamber Life support control Hyperbaric evacuation system G10 G11 G12 Simultaneous operations [SIMOPS] Extreme Weather [Section 3] Inability to maintain life support Cold suffocation Damage to pipeline/subsea structures [Section 5.2 & Section 3] Impact damage to installation [Section 2] Positioning Failure [Section 4.2] HS4 Common systems G13 Compressors & pumps High pressure gas storage Breathing gas and environmental control systems Power generation & management. G14 Other structures G15 Collision of bell/basket with subsea structures Anchor wire EER arrangements [Section 10] Dynamic positioning/ mooring failure F3 Factors which may affect the consequence Number of Divers exposed Proximity of hydrocarbons [Section 5.1] F9 Supervision EER Co-ordination [Section 6] F8 Mitigation emergency procedures [Section 10] Location of dive system [siting of the facility] Firefighting deluge [Sections 5.3 & 9] Human factors Selection Training Competence Operating procedures competency [Section 11] Manning issues Client review/acceptance of procedures Emergency Audit
Initiators
Procedural Failure [Section 11] Incorrect/inappropriate F2
Risk Evaluation
Consequences Uncontrolled decompression F7

Control diving policy PTW [Section 11]
Procedures Operating
218

HS5 Diving Platform DSVs Offshore installation G16
Initiators
Fire & Explosion [Sections 5.3 & 9] Any fire or explosion in vicinity of dive system affecting essential services Sinking of DSV G17 G18 Subsea Releases
Risk Evaluation
219
7.HS1:
1.
Divers Life Support Equipment
Confirmation should be obtained that the duty holders management system will ensure that the divers life support equipment [ie heating system, umbilicals and personal equipment] will be designed, constructed and maintained and will be operated in accordance with relevant recognised standards and guidance. These include: Diving Equipment Systems Inspection Guidance Note [DESIGN] IMCA 1995 IMCA D 010 [Rev 2] Diving Operations from Vessels Operating in DP Mode IMCA D0 018 (2) Code of Practice on The Initial and Periodic Examination, Testing and Certification of Diving Plant and Equipment IMCA D023 Diving Equipments Systems Inspection Guidance Note for Surface Oriented Diving Systems (Air) IMCA D 28/98 Minimum Supervisory Requirements for Offshore Diving Operations Carried Out on the UK Continental Shelf Guidelines for Offshore Installation Safety Cases: Diving Operations from Vessels. A Joint Industry Guide UKOOA 1993 Would also include the offshore ACOP and relevant HSE Diving Information Sheets.
2.
Where a standard/code of practice other than those listed above has been employed, judgements as to the adequacy of the life support equipment can only be assessed on an individual basis, and the duty holder should be required to justify why its procedures/practices in the relevant areas will deliver an equivalent level of health and safety performance. Relevant Legislation, ACOP and Guidance includes: Offshore Installations (Safety Case) Regulations 2005 and Guidance on Regulations Assessment Principles for Offshore Safety Cases [APOSC]
3.
4.
Specific Technical Issues: For permanent onboard diving equipment the security of these systems should be discussed. For temporary equipment the management arrangements for any integration into the platform systems should be described. The effect on diving systems of platform incidents and/or extreme weather should be discussed either for the installed equipment or for the outline of possible temporary equipment.
5.
Other Related Assessment Sheets in this Section are: 7.HS2 7.HS3 7.HS4 Diving/Basket Systems Deck Chamber Complex Common Systems
6.
Cross-Referenced Sections and Sheets are: Section 4.2 Section 5.3 Loss of Maritime Integrity - Loss of Position Loss of Containment - Fire and Explosion [Fire and Explosion in vicinity of the dive system]
220
Section 9 Section 11 7.
Non Process Fires & Explosions [Fire and Explosion in vicinity of the dive system] Human Factors
Lead Assessment Section for this Sheet: OSD4.6 or 4.7 [dependant on location]
8.
221
7.HS2:
1.
Diving Bell/Basket Systems
Confirmation should be obtained that the duty holders management system will ensure that the diving bell/basket systems are designed, construction and maintained and will be operated in accordance with relevant recognised standards and guidance. These include: Diving Equipment Systems Inspection Guidance Note [DESIGN] IMCA 1995 OTH 91 338 Maintenance, Inspection and Discard of Diving Bell Hoist Ropes HSE Books 1993 ISBN 0 11 886387 8 BS ISO 4309:2004 Cranes. Wire Ropes. Care, Maintenance, Installation, Examination and Discard BS EN 12385 3:2004 Steel Wire Ropes. Safety Information for Use and Maintenance. OTO 97 063 Degradation of Galvanised Multi Strand Wire Ropes HSE 1997 Guidelines for Offshore Installation Safety Cases: Diving Operations from Vessels. A Joint Industry Guide UKOOA 1993 IMCA D 010 [Rev 2] Diving Operations from Vessels in DP Mode IMCA D0 018 Code of Practice on The Initial and Periodic Examination, Testing and Certification of Diving Plant and Equipment IMCA D023 Diving Equipments Systems Inspection Guidance Note for Surface Oriented Diving Systems [Air] IMCA DO 24 Diving Equipment Systems Inspection Guidance Note for Saturation Diving Systems [Bell] IMCA D 28/98 Minimum Supervisory Requirements for Offshore Diving Operations Carried Out on the UK Continental Shelf Would also include the offshore ACOP and relevant HSE Diving Information Sheets.
2.
Where a standard/code of practice other than those listed above has been employed, judgement as to the adequacy of the diving bell/basket systems can only be assessed on an individual basis and the duty holder should be required to justify why its procedures/practices in the relevant areas will deliver an equivalent level of health and safety performance. Relevant Legislation, ACOP and Guidance includes: Offshore Installations (Safety Case) Regulations 2005 and Guidance on Regulations Assessment Principles for Offshore Safety Cases [APOSC]
3.
4.
Specific Technical Issues: Clearly the detailed specification of the system in use will be part of the diving contractors Diving Project Plan. In addition the actions to be carried out if a diving bell becomes detached from the system or if the divers are trapped in the bell or habitat will be contained in the Diving Project Plan which is the prime responsibility of the diving contractor under DWR. The safety case duty holder will probably be required to provide assistance particularly in co-ordinating any wider emergency response. If diving operations are envisaged, arrangements for providing this assistance should be documented in the safety case. Depending on the operational circumstances this might take various forms from a very detailed and specific support document to a simple statement of intent by the duty holder. The latter will usually be acceptable in a safety
222
case but will, of course, need to be expanded when a diving contract has been placed and before diving operations commenced. This would be evaluated during inspection activities. Formal procedures for providing assistance in the event of a detached diving bell or habitat are recommended. 5. Other Related Assessment Sheets in this Section are: 7.HS1 7.HS3 7.HS4 6. Divers Life Support Equipment Deck Chamber Complex Common Systems
Cross-Referenced Sections and Sheets are: Section 4.2 Section 5.3 Section 9 Section 11 Loss of Maritime Integrity - Loss of Position Loss of Containment - Fire and Explosion [Fire and Explosion in vicinity of the dive system] Non Process Fires & Explosions [Fire and Explosion in vicinity of the dive system] Human Factors
7.
8.
223
7.HS3:
1.
Deck Chamber Complex
Confirmation should be obtained that the duty holders management system will ensure that deck chamber complexes are designed, constructed and maintained and will be operated in accordance with relevant recognised standards and guidance. These include: Diving Equipment Systems Inspection Guidance Note [DESIGN] IMCA 1995 AODC Guidance Note Number 029: Oxygen Cleaning, published by IMCA AODC Guidance Note Number 016 Rev 1: Marking and Colour Coding of Gas Cylinders, Quads and Tanks for Diving Applications, published by IMCA. BS EN 1089-3 1997 Transportable Gas Cylinders - Cylinder Identification. Part 3: Colour Coding AODC Guidance Note 016 Rev 1, published by IMCA IMCA D0 018 Code of Practice on The Initial and Periodic Examination, Testing and Certification of Diving Plant and Equipment IMCA D023 Diving Equipments Systems Inspection Guidance Note for Surface Oriented Diving Systems (Air) IMCA D 28/98 Minimum Supervisory Requirements for Offshore Diving Operations Carried Out on the UK Continental Shelf IMCA D 025 Evacuation of Divers from Installations Would also include the offshore ACOP and relevant HSE Diving Information Sheets.
2.
Where a standard/code of practice other than those listed above has been employed, judgement as to the adequacy of the deck chamber complex can only be assessed on an individual basis and the duty holder should be required to justify why its procedures/practices in the relevant areas will deliver an equivalent level of health and safety performance. Relevant Legislation, ACOP and Guidance includes: Offshore Installations (Safety Case) Regulations 2005 and Guidance on Regulations Assessment Principles for Offshore Safety Cases [APOSC]
3.
4.
Specific Technical Issues: For permanent onboard diving equipment the security of these systems should be discussed and should be included in the verification scheme. There should be a company policy preventing the over swinging of pressurised systems and gas storage banks, and formal procedures for the evacuation of divers from an installation based dive system in the event of platform abandonment. For temporary equipment the management arrangements for any integration into the platform systems should be described. There should be a system for revising the verification scheme to cover the diving systems presence on the installation. The effect on diving systems of platform incidents and/or extreme weather should be discussed either for the installed equipment or for the outline of possible temporary equipment.
224
5.
Other Related Assessment Sheets in this Section are: 7.HS1 7.HS4 Divers Life Support Equipment Common Systems
6.
Cross-Referenced Sections and Sheets are: Section 5.3 Section 9 Section 11 Loss of Containment - Fire and Explosion [Fire and Explosion in vicinity of the dive system] Non Process Fires & Explosions [Fire and Explosion in vicinity of the dive system] Human Factors
7.
8.
225
7.HS4:
1.
Common Systems
Confirmation should be obtained that the duty holders management system will ensure that the common systems [ie compressors, pumps, high pressure gas storage, breathing gas and environmental control systems, power generation and management systems] will be designed, constructed and maintained and will be operated in accordance with relevant recognised standards and guidance. These include: Diving Equipment Systems Inspection Guidance Note [DESIGN] IMCA 1995 IMCA D 025 Evacuation of Divers from Installations IMCA D0 018 (2) Code of Practice on The Initial and Periodic Examination, Testing and Certification of Diving Plant and Equipment IMCA D023 Diving Equipments Systems Inspection Guidance Note for Surface Oriented Diving Systems (Air) IMCA D 28/98 Minimum Supervisory Requirements for Offshore Diving Operations Carried Out on the UK Continental Shelf Guidelines for Offshore Installation Safety Cases: Diving Operations from Vessels. A Joint Industry Guide UKOOA 1993 Would also include the offshore ACOP and relevant HSE Diving Information Sheets.
2.
Where a standard/code of practice other than those listed above has been employed, judgement as to the adequacy of the common systems can only be assessed on an individual basis and the duty holder should be required to justify why its procedures/practices in the relevant areas will deliver an equivalent level of health and safety performance. Relevant Legislation, ACOP and Guidance includes: Offshore Installations (Safety Case) Regulations 2005 and Guidance on Regulations Assessment Principles for Offshore Safety Cases [APOSC]
3.
4.
Specific Technical Issues: For permanent onboard equipment the security of these systems should be discussed. For temporary equipment the management arrangements for any integration into the platform systems should be described. The effect on diving systems of platform incidents and/or extreme weather should be discussed either for the installed equipment or for the outline of possible temporary equipment. There should be a company policy preventing the over swinging of pressurised systems and gas storage banks.
5.
6.
Cross-Referenced Sections and Sheets are: Section 5.3 Section 9 Loss of Containment - Fire and Explosion [Fire and Explosion in vicinity of the dive system] Non Process Fires & Explosions [Fire and Explosion in vicinity of the dive system]
226
Section 11 7.
Human Factors
8.
227
7.HS5:
1.
Diving Platform
Confirmation should be obtained that the duty holders management system will ensure that the diving platform will be designed, constructed and maintained and will be operated in accordance with relevant recognised standards and guidance. These include: Diving Equipment Systems Inspection Guidance Note [DESIGN] IMCA 1995 Guidelines for Offshore Installation Safety Cases: Diving Operations from Vessels. A Joint Industry Guide UKOOA 1993 DPVOA - 1611/14 DP Vessel Owners Association: DP Position Loss risks in Shallow Water GM - 1611/01-0189-650 DP Vessel Owners Association: Guidelines for the Design and Operation of Dynamically Positioned Vessels Guidelines for the Specification and Operation of Dynamically Positioned Diving Support Vessels - Norwegian Petroleum Directorate - Petroleum engineering division of the UK Department of Energy. IMCA D 010 [Rev 2] Diving Operations from Vessels Operating in DP Mode IMCA D 006 [Rev 2] Diving Operations in the Vicinity of Pipelines. IMCA D0 018 Code of Practice on The Initial and Periodic Examination, Testing and Certification of Diving Plant and Equipment IMCA D023 Diving Equipments Systems Inspection Guidance Note for Surface Oriented Diving Systems (Air) IMCA D 28/98 Minimum Supervisory Requirements for Offshore Diving Operations Carried Out on the UK Continental Shelf IMCA D 025 Evacuation of Divers from Installations Would also include the offshore ACOP and relevant HSE Diving Information Sheets.
2.
Where a standard/code of practice other than those listed above has been employed, judgement as to the adequacy of the diving platform can only be assessed on an individual basis and the duty holder should be required to justify why its procedures/practices in the relevant areas will deliver an equivalent level of health and safety performance. Relevant Legislation, ACOP and Guidance includes: Offshore Installations (Safety Case) Regulations 2005 and Guidance on Regulations Assessment Principles for Offshore Safety Cases [APOSC]
3.
4.
Specific Technical Issues: Danger to the installation platform from a fire, explosion or the release of a dangerous substance from a diving system is considered to be low provided a sound system of maintenance and inspection is in place. Diving systems permanently onboard installations should be included in the verification scheme. Incidents from a vessel based system should also be considered though the consequences for the installation will probably be much reduced and can be discounted.
228
Collision of the DSV with the installation is a credible event which may have major consequences. The UKOOA Guidelines referred to above should be referred to in the safety case or companies manuals. There should be a management system in place to ensure that the diving system onboard DSVs used in connection with installations is maintained to a similar standard as onboard systems. 5. Other Related Assessment Sheets in this Section are: None 6. Cross-Referenced Sections and Sheets are: Section 3 Section 4.1 Section 4.2 Section 5.3 Section 9 Section 11 7. Loss of Structural Integrity Loss of Maritime Integrity - Loss of Stability Loss of Maritime Integrity - Loss of Position Loss of Containment - Fire and Explosion [Fire and Explosion in vicinity of the dive system] Non Process Fires & Explosions [Fire and Explosion in vicinity of the dive system] Human Factors
8.
229
7.F1-F3:
1.
Risk Evaluation
Confirmation should be obtained that that the safety case considers the risks associated with and from diving including the likelihood of an incident, the consequences and the factors affecting the consequence. There are no standards associated with the likelihood of an accident occurring, but the duty holder would be required to demonstrate that diving project plans and where appropriate the safety case takes into consideration the following guidance and standards: DMAC 028 Provision of Emergency Medical Care for Divers in Saturation DMAC 22 Proximity to a Recompression Chamber after Surfacing DMAC 21 The Duration of Saturation Exposures and Surface Intervals Following Saturation DPVOA - 1611/14 DP Vessel Owners Association: DP Position Loss Risks in Shallow Water IMCA D025 Evacuation of Divers from Installations Would also include the offshore ACOP and relevant HSE Diving Information Sheets.
2.
Where a standard/code of practice other than those listed above has been employed, judgement as to the adequacy of the safety case can only be assessed on an individual basis and the duty holder should be required to justify why its procedures/practices in the relevant areas will deliver an equivalent level of health and safety performance. Relevant Legislation, ACOP and Guidance includes: Offshore Installations (Safety Case) Regulations 2005 and Guidance on Regulations Assessment Principles for Offshore Safety Cases [APOSC]
3.
4.
Specific Technical Issues: The duty holder should demonstrate that for any given diving project that all risks will be considered. These would include any historic data available, the selection of the type of diving [including the necessity for diving], the layout and design of the dive system, the DSV performance [if appropriate], the competence of those involved in the project and the project scheduling and timeframe [including weather considerations]. There could be situations where divers are at risk because their work activity prevents them from taking the normal action available to a conventional member of the workforce because they are in the pressure chamber. For such situations, emergency procedures for the evacuation of the divers would be provided. These specialised arrangements will largely be the responsibility of the diving contractor, but when the diving is taking place from an installation there is a requirement on the duty holder to co-operate. The amount of detail will vary depending on the type of installation and the diving system. Where divers are on the installation they should be included in the PFEER assessment and in the summary included in the safety case.
5.
Other Related Assessment Sheets in this Section are: 7.HS1 Divers Life Support Equipment
6.
230
Section 2 Section 5.1 Section 5.2 Section 5.3 Section 10 7.
Vessel Impact (Impact damage to the installation) Loss of Containment - Process (Proximity of hydrocarbons) Loss of Containment - Pipelines Loss of Containment - Fire and Explosion Emergency Response
8.
231
7.F1-F3:
1.
Risk Evaluation
Confirmation should be obtained that that the safety case considers the risks associated with and from diving including the likelihood of an incident, the consequences and the factors affecting the consequence. There are no standards associated with the likelihood of an accident occurring, but the duty holder would be required to demonstrate that diving project plans and where appropriate the safety case takes into consideration the following guidance and standards: DMAC 028 Provision of Emergency Medical Care for Divers in Saturation DMAC 22 Proximity to a Recompression Chamber after Surfacing DMAC 21 The Duration of Saturation Exposures and Surface Intervals Following Saturation DPVOA - 1611/14 DP Vessel Owners Association: DP Position Loss Risks in Shallow Water IMCA D025 Evacuation of Divers from Installations Would also include the offshore ACOP and relevant HSE Diving Information Sheets.
2.
Where a standard/code of practice other than those listed above has been employed, judgement as to the adequacy of the safety case can only be assessed on an individual basis and the duty holder should be required to justify why its procedures/practices in the relevant areas will deliver an equivalent level of health and safety performance. Relevant Legislation, ACOP and Guidance includes: Offshore Installations (Safety Case) Regulations 2005 and Guidance on Regulations Assessment Principles for Offshore Safety Cases [APOSC]
3.
4.
Specific Technical Issues: The duty holder should demonstrate that for any given diving project that all risks will be considered. These would include any historic data available, the selection of the type of diving [including the necessity for diving], the layout and design of the dive system, the DSV performance [if appropriate], the competence of those involved in the project and the project scheduling and timeframe [including weather considerations]. There could be situations where divers are at risk because their work activity prevents them from taking the normal action available to a conventional member of the workforce because they are in the pressure chamber. For such situations, emergency procedures for the evacuation of the divers would be provided. These specialised arrangements will largely be the responsibility of the diving contractor, but when the diving is taking place from an installation there is a requirement on the duty holder to co-operate. The amount of detail will vary depending on the type of installation and the diving system. Where divers are on the installation they should be included in the PFEER assessment and in the summary included in the safety case.
5.
Other Related Assessment Sheets in this Section are: 7.HS1 Divers Life Support Equipment
6.
232
Section 2 Section 5.1 Section 5.2 Section 5.3 Section 10 7.
Vessel Impact (Impact damage to the installation) Loss of Containment - Process (Proximity of hydrocarbons) Loss of Containment - Pipelines Loss of Containment - Fire and Explosion Emergency Response
8.
233
7.F4-F9:
1.
Confirmation should be obtained that the duty holders safety management system takes into account relevant recognised standards and guidance. These include: All IMCA Guidance and other industry guidance identified in other sheets of this section, HSE diving information sheets, the Offshore ACOP and other HSE guidance such as HSG 65.
2.
Where a standard/code of practice other than those listed above has been employed, judgement as to the adequacy of the risk management measures can only be assessed on an individual basis and the duty holder should be required to justify why its procedures/practices in the relevant areas will deliver an equivalent level of health and safety performance. Relevant Legislation, ACOP and Guidance includes: Offshore Installations (Safety Case) Regulations 2005 and Guidance on Regulations Assessment Principles for Offshore Safety Cases [APOSC]
3.
4.
Specific Technical Issues: The duty holders responsibility as the client for the diving project should be assessed. The responsibility for the detailed management of the safety of the diving project will be the responsibility of the diving contractor. The safety case, where appropriate, should have risk management measures in place to ensure that alternatives to diving are adequately considered. For diving operations, there should be adequate consideration of simultaneous operations, familiarisation of diving personnel with installation and vice versa, and hazard identification [client with contractor and vice versa]. There should be a system of dive system and vessel auditing, and client review/acceptance of procedures. The purpose of the assessment is to check that the management system is adequate to ensure that the relevant statutory provisions will be complied with in relation to the installation and any activity on or in connection with it. The standard of demonstration required in the case is at a high level which will mainly, be carried out by the team responsible for the SMS assessment. Tests should be carried out that envisaged diving projects will be adequately covered. This check of the SMS should include competence of the duty holder, and procedures to ensure competence of diving contractors.
5.
Other Related Assessment Sheets in this Section are: 7.HS1 7.HS2 7.HS3 7.HS4 7.HS5 Divers Life Support Equipment Diving Bell/Basket Systems Deck Chamber Complex Common systems Diving Platform
6.
Cross-Referenced Sections and Sheets are: Section 5.3 Loss of Containment - Fire and Explosion [Fire and Explosion in vicinity of the dive system]
234
Section 9 Section 10 Section 11 7.
Non Process Fires & Explosions [Fire and Explosion in vicinity of the dive system] Emergency Response Human Factors
8.
235
8.
1.
HELICOPTER CRASH
Scope This Section provides guidance for the assessment of safety case content with respect to the collision of a helicopter with the installation, from hazard identification through to consequence determination, including risk management measures. It covers the major accident hazards of:

2.
Helicopters used for day-to-day transport and SAR duties; and Fixed wing military aircraft if considered foreseeable because of the installations possible proximity to bombing ranges or other military activities.
Assessment of Adequacy of Demonstration The evaluation of risk that might stem from each major accident hazard is to be assessed by identification of the factors that might result in an adverse combination of a source of hazard and initiator [causal chains], together with identification and evaluation of escalation paths that might result [consequence chains]. The helicopter crash major accident hazard prompts have been classified as follows:
Helicopter crash major accident hazards that are specified in the Safety Case Regulations [ie helicopters or other relevant aircraft]. Any other event involving death or serious personal injury to 5 or more persons on the installation or engaged in an activity in connection with it.

3.
Helideck design/systems. Aircraft systems performance. Operational/procedural factors. Human error [helideck/aircrew].
Depth of Assessment This section gives guidance on the depth of assessment required to determine the adequacy of the demonstration that measures have been or will be taken to ensure compliance with the relevant statutory provisions. Where safety case contents match with good practice identified in the assessment sheets for a particular sheet associated with a major accident there will usually be no need for an assessor to probe into the details of how the good practice is applied. This may, however, be a suitable issue for follow-up by inspection.
236
4. The assessor should examine the adequacy of the hazard identification, risk evaluation and management in conjunction with the contents of the Categorisation table below.
Helicopter Crash Source of Hazard
HS1 HS2 Helicopters Other relevant aircraft [eg military aircraft] G1
Initiators
Helideck design/systems Proximity of tall structures/ obstacles wind turbulence F1
Risk Evaluation
Frequency Historic Accident Data F10 F11

Inherent Safety Eliminate/reduce helicopter use Optimised helideck design
Helideck Operations Radio Operators Procedures
thermal plume effects
F2
Company/Installatio n Data Installation Specific Risk Studies Military flight data Consequences
F12
SCE Verification
Helideck design Helicopter landing areas
Navigational/communications failure. G2 Operational/Procedural Factors Landing aids failure
F3
Prevention
F4
F13 F14
Company transportation policy/ procedures Fire Prevention Measures [Sections 5.1, 5.3, 5.9] Correct operational procedures
Extreme weather/environmental
F5
Process/non process fire [Sections 5.1,5.3, 5.9] Structural damage to helideck/elsewhere [Section 3] Loss of damage to EER Plan [Section 10]
F15
Installation movements [mobiles]
F6
F16
Competent personnel client review/acceptance of procedures Detection
Incorrect/inappropriate procedures
F7
237
Helicopter Crash Source of Hazard Initiators

Lack of awareness of flying restrictions F8
Risk Evaluation
Implications to EER Plan [Section 10] F17 F18

Monitoring of helicopter Communications with Aircrew Unsafe Conditions Helicopter Status Lights
Inadequate communications
F9
Helicopter crash on helideck/installation/ in sea
F19 F20
Inaccurate helicopter payload manifests G3 Human Error [Helideck Crew] Commission/omission Errors/fatigues Inadequate training
Aircraft Systems Performance/Air Worthiness Engine/systems failure Navigational aids failure Helicopter design Pilot error Bird strikes
238
8.HS1 8.HS2:
1.
Helicopters Other Aircraft
The assessor to confirm that all helidecks have been designed and that all associated helideck and helicopter operations are managed in accordance with the relevant CAA/OPITO standards and industry guidelines. Recognised standards/codes of practice include: CAA CAP 437 Offshore Helicopter Landing Areas Guidance on Standards OIAC HLG Design Guide HSE Safety Notice 1/94 Mobile Installations & Vessels: Movement of Helidecks HSE Safety Notice 2/2004 Offshore Helidecks - Testing of Helideck Foam Production Systems HSE Operations Notice 6 Reporting of Offshore Installation Movements HSE Operations Notice 14 Guidance on Coast Protection Act consent to locate and the marking offshore installations UKOOA Guidelines for the Management of Offshore Helideck Operations CAPs 452/535 Radio Operators Guides Cogent/OPITO Approved Helideck Training Standards UKOOA Guidelines for Management of Safety Critical Elements
2.
Where a standard/code of practice other than those listed above has been employed then the duty holder should be required to justify why its procedures/practices in the relevant areas will deliver an equivalent level of health and safety performance. Relevant Legislation, ACOP and Guidance includes: Offshore Installations (Safety Case) Regulations 2005 and Guidance on Regulations (L30) Assessment Principles for Offshore Safety Cases [APOSC] Offshore Installations and Wells (Design and Construction, etc) Regulations 1996 and Guidance on Regulations (L85) Offshore Installations (Prevention of Fire and Explosion, and Emergency Response) Regulations 1995 and Approved Code of Practice (L65)
3.
4.
Specific Technical Issues: Hazard identification should include helicopters and other aircraft such as military aircraft since SCR Regulation 2 defines the collision of a helicopter with an installation as a major accident and any other event likely to cause death or serious injury to 5 or more persons. Since the collision of a civil fixed wing aircraft with an installation is not considered reasonably foreseeable the duty holder should not be expected to include this in the hazard identification process. Although a helicopter ditching in the sea in the vicinity of an installation is outside the scope of SCR [SCR ACOP para 67] the duty holder would be expected to demonstrate compliance with PFEER Regulation 17 - Arrangements for Recovery and Rescue.
239
Duty holders will generally have no control over initiating events associated with the airworthiness, technical and operational requirements of helicopters or military aircraft, aircrew performance. Therefore they should not be expected to address initiating events which are within the remit of aviation regulations. However, duty holders [the operator/owner of a fixed/mobile installation] are required under Regulation 11 of DCR to ensure that the helideck design, construction and operating environment is such that helicopter operators can discharge their duty under aviation legislation. Duty holders are responsible for the safety of the helideck and helideck operations, specifically those associated with helicopter landings and take-offs. They are required to ensure that the helideck operating environment is such that helicopter operators can discharge their duty. They have direct control over the physical characteristics of the helideck, the levels and manning of the rescue and firefighting and provision of communications. They are required to ensure that competent personnel control all activities on the helideck during helicopter operations, suggest routes to be flown and have in place a weather policy for passenger safety on the helideck and for passenger survival and rescue. They should demonstrate that appropriate safety management systems and audit arrangements are in place, and include suitable reference to such management systems in their safety cases. For mobile installations and floating fixed installations, topic assessors [TAs] should be looking for evidence that initiating events associated with helideck movements and the likely causes have been considered. [Duty holders are also required to collect, store and transmit accurate weather and oceanographic data, and information relating to installation motions]. Potential deficiencies in helideck design and construction require assessment preferably at the design stage. For example, an initiating event can be contact with, or turbulent airflow caused by adjacent structures, or obstacles on the installation or on installations nearby, or thermal effects arising from plant exhausts such as gas turbines situated near the helideck. TAs should look for evidence in a design safety case as well as an operational safety case that the duty holder has taken into account published guidance. Inadequate communications, training of appropriate personnel, and wrong rig landings can also be classed as initiating events. Although there is little that the duty holder can do about aircrew competence, appropriate operational procedures on the installation and effective helideck crew training policies should be in place. There should be evidence that a process of SCE identification and verification is in place as required by SCR/DCR for controlling the risks of helicopter/ aircraft collision. 5. Other Related Assessment Sheets in this Section are: 8.F1-F9 8.F10-F20 6. Risk Evaluation Risk Management Measures
Cross-Referenced Sections and Sheets are: Section 3 Section 4.1 Section 4.2 Section 5.1 Section 5.3 Section 9 Section 10 Section 11 Loss of Structural Integrity Loss of Maritime Integrity - Loss of Stability Loss of Maritime Integrity - Loss of Position Loss of Containment - Process Loss of Containment - Fire & Explosion Non Process Fires & Explosion Emergency Response Human Factors
240
7.
8.
241
8.F1-F9:
1.
Risk Evaluation
Confirmation should be obtained that risk evaluation has been carried out in accordance with industry guidelines and is based on recognised risk data sources, for example: CMPT: A Guide to QRA for Offshore Installations UKOOA guidelines for QRA Uncertainty UKOOA guidelines: Formal Safety Assessment CAA Mandatory Occurrence Reports CAA data OGP data
2.
Where a standard/code of practice other than those listed above has been employed, judgements as to the adequacy of the safety case can only be assessed on an individual basis, and the duty holder should be required to justify why its procedures/practices in the relevant areas will deliver an equivalent level of health and safety performance. Relevant Legislation, ACOP and Guidance includes: Offshore Installations (Safety Case) Regulations 2005 and Guidance on Regulations (L30) Assessment Principles for Offshore Safety Cases [APOSC] Offshore Installations and Wells (Design and Construction, etc) Regulations 1996 and Guidance on Regulations (L85) Offshore Installations (Prevention of Fire and Explosion, and Emergency response) Regulations 1995 and Approved Code of Practice (L65)
3.
4.
Specific Technical Issues: The most comprehensive sources of helicopter accident data for assisting with risk analysis are likely to have been published by CAA as well as from research studies commissioned by HSE, CAA and industry. It is therefore unlikely that a proper risk analysis can be carried out without reference to at least the CAA data. The duty holders risk analysis should take account of installation specifics, for example the type of helicopter used, and the companys transportation policies which will affect the frequency of helicopter operations to and from the installation or vessel. [Although offshore regulations do not require transport risk to be included in safety cases duty holders do address this in their submissions. We should not discourage this approach]. The duty holder should take into account the risks associated with military aircraft over flying the installation and that MOD have been consulted to obtain data which will assist with a risk analysis. Although not mandatory or prescribed some duty holders have found it helpful to calculate risks in terms of risks to individuals [IR] and as potential loss of life [PLL]. This allows comparisons to be made of the risks to personnel with HSEs risk acceptability criteria both for helideck personnel and the rest of the workforce on the installation, and to personnel arising from helicopter crashes on the helideck, elsewhere on the installation, or where appropriate, on a NUI. For major modifications and resubmissions, the duty holder should take into account any changes to working practices which may affect the risk of helicopter collisions.
242
The likely consequences will depend on where the helicopter impacts the installation, the approach speed, the degree of structural damage to the helideck or elsewhere, the possibility of fire, and the effect on EER systems and arrangements. The safety case should therefore contain evidence that foreseeable points of impact on the installation, escalation potentials and all likely scenarios have been considered. 5. Other Related Assessment Sheets in this Section are: 8.HS1/8.HS2 Helicopters/Other Aircraft 8.F10-8.F20 6. Risk Management Measures
Cross-Referenced Sections and Sheets are: Section 3 Section 5.1 Section 5.3 Section 9 Section 10 Loss of Structural Integrity Loss of Containment - Process Loss of Containment - Fire and Explosion Non Process Fires and Explosions Emergency Response
7.
8.
243
8.F10-F20:
1.
Confirmation should be obtained that full account has been taken of industry guidelines, cited in the previous assessment sheets, when assessing the measures needed to manage risk. Where a standard/code of practice other than those referred to above has been employed, judgements as to the adequacy of the risk management measures can only be assessed on an individual basis, and the duty holder should be required to justify why its procedures/practices in the relevant areas will deliver an equivalent level of health and safety performance. Relevant Legislation, ACOP and Guidance includes: Offshore Installations (Safety Case) Regulations 2005 and Guidance on Regulations (L30) Assessment Principles for Offshore Safety Cases [APOSC] Offshore Installations (Prevention of Fire and Explosion, and Emergency Response) Regulations 1995 and Approved Code of Practice (L65) Offshore Installations and Wells (Design and Construction, etc) Regulations 1996 and Guidance on Regulations (L85)
2.
3.
4.
Specific Technical Issues: The duty holder is required to list safety critical elements [SCEs], have them subject to independent review and develop a scheme for verification of their performance throughout the lifecycle of the installation. An offshore helideck is a collection of systems, some of which are safety critical because of the helidecks function as a means of evacuation, or because their purpose is to limit the effects of a helicopter crash. For these reasons the safety case should provide evidence of a SCE verification scheme with respect to helidecks. The greatest scope for eliminating or minimising a helicopter collision is to consider at the conceptual and detailed design stage those features of a helideck which could affect helicopter operations and compromise safety. The duty holder should therefore demonstrate in the design safety case that the routine and key technical issues, known to arise in the design and construction of offshore helidecks and related operations, have been addressed. Total elimination of helicopter movements is probably unrealistic, however, it may still be possible to reduce the need for helicopters to visit an installation either by improved planning or management of logistics. A TA should therefore look for evidence in a safety case of how the number of helicopter visits to both NAIs and NUIs [where appropriate] could be reduced or kept to a minimum. The safety case should provide evidence of documented helicopter operational procedures for managing the risks associated with the initiating events [where appropriate] which have been listed under 8.G3 and that consideration has been given to personnel competencies, and the necessary preventative and detection measures [see 8.F11 to 8.F20]. The appropriate systems and procedures for protecting personnel [including aircrew and helicopter passengers] from the consequences of a helicopter collision should be described in the safety case. CAP 437 and UKOOA guidelines describe what is considered to be best practice with respect to the helideck fire fighting facilities, personnel training and emergency procedures. The duty holder should therefore demonstrate that procedures are in place which are based on this guidance. A helicopter [or other aircraft if considered foreseeable] colliding with the installation may lead to a need for evacuation,
244
or render the helideck unavailable for evacuation. The duty holder should therefore confirm that the emergency procedures manual for that installation specifies the action to be taken following such events. 5. Other Related Assessment Sheets in this Section are: 8.HS1/8.HS2 8.F1-8.F9 6. Helicopters/Other Aircraft Risk Evaluation
Cross-Referenced Sections and Sheets are: Section 4.1 Section 4.2 Section 5.1 Section 5.3 Section 9 Section 10 Section 11 Loss of Marine Integrity - Loss of Stability Loss of Marine Integrity - Loss of Position Loss of Containment - Process Loss of Containment - Fire & Explosion Non Process Fires & Explosions Emergency Response Human Factors
7.
8.
245
9.
1.
NON PROCESS FIRES & EXPLOSIONS

Scope This Section provides guidance for the assessment of safety case content with respect to incidents originating from non-process plant, leading to fires and explosions. The assessment procedure includes hazard identification, consequence determination and risk management measures.
2.
Assessment of Adequacy of Demonstration The evaluation of risk that might stem from each major accident hazard is to be assessed by identification of the factors that might result in an adverse combination of a source of hazard and initiator, together with identification and evaluation of escalation paths that might result. Potential sources of hazard, initiators, etc, are shown in the document. Assessors should ensure that, where relevant, safety cases contain information demonstrating that consideration has been given to each of these factors.
3.
Depth of Assessment This section gives guidance on the depth of assessment required to determine the adequacy of the demonstration that measures have been or will be taken to ensure compliance with the relevant statutory provisions. Where safety case contents match with good practice identified in the assessment sheets for a particular element associated with a major accident, there will usually be no need for an assessor to probe into the details of how the good practice is applied. This may, however, be a suitable issue for follow-up by inspection. 4. The assessor should examine the adequacy of the hazard identification, risk evaluation and management in conjunction with the contents of the categorisation tablebelow
246
Non Process Fires & Explosions Source of Hazard

HS1 Accommodation Fires - Laundry Fire - Galley Fire Escalation from Process Events Impact Corrosion Induced Failure Inadequate Design Incorrect Usage Incorrect Material Specification Dropped Containers HS2 Cellulosic Fires - Pallet Fire Inadequate Maintenance Overheating Procedural Inadequacies HS3 Electrical Fires Vibration Induced Failure Prevention Electrical Zoning Ex Rating Hot and Cold Work Policies Detection *Ignition Sources/Ex Rating/ Electrical Zoning Hot and Cold Work Policies Non Flammable Materials Delayed or Immediate Ignition Containment Strength Energy of Ignition Material Specification Flash Fire or Explosion Low Risk Location Certification Schemes Impact Protection
Initiators
Ignition *Solid No Inventory Human Factors
Risk Evaluation
Frequency Ignition Probability

Inherent Safety Intrinsically Safe Electrical Equipment Separate Accommodation Jacket
Fire Resistant Structures Inventory Size Fire Load Limits Impact Loads
247
Non Process Fires & Explosions Source of Hazard

HS4 Non Cellulosic Fires & Explosions - Gas Cylinder Fires - Helifuel Fires - Methanol Fires - Gas Cylinder Explosions *Open/Closed Modules Ventilation Rates Confinement/Layout Resistant Temporary Refuges Potential for Escalation Deluge *Separation/Layout Sprinklers Fire Models Used & Assumptions Made Fire Resistance of Potential Targets Human Vulnerability PFP Effectiveness Type of Fire Thermal Flux/Smoke Generation Shielding Vulnerability of Potential Targets to Fire/Heat Smoke Dispersion TR Vulnerability to Smoke Ingress Passive Fire Protection Fire Walls Passive Fire Protection
Initiators
Risk Evaluation
Consequences Cellulosic Load Solids only Size of Release Dispersion

Fire Detectors/Alarms Smoke Detectors/Alarms
Mitigation
248
9.HS1:
Introduction
Accommodation Fires
Accommodation fires are defined as those fires that occur in the accommodation spaces, including the control room and TR. They will be predominantly cellulosic fires from combustible non-hydrocarbon sources, for example, soft furnishings, blankets, lint in laundries etc. 1. Confirmation should be obtained that fires in accommodation areas have been analysed in accordance with a recognised standard or code of practice. Onshore Building Regulations are suitable standards to follow in assessing offshore accommodation modules for fire resistance. Recognised standards/ Codes of Practice include: BS 5839 1988 Fire detection and alarm systems for buildings ISO 13702:1999 Petroleum and Natural Gas Industries Control and Mitigation of Fires and Explosions on Offshore Production Installations Requirements and Guidelines SI 1991/2768 The Building Regulations UKOOA Guidelines for Fire & Explosion Hazard Management 1995 IEC 6033-1 & 2 Safety of Household and Similar Electrical Appliances Recommendations for the Use of Electrical and Electronic Equipment for Mobile and Fixed Offshore Platforms IEE 1992 Eurocode 1: Basis of design and actions on structures. Part 2.2 Actions on structures exposed to fire 2. Where a standard/code of practice other than those listed above has been employed, judgement as to the adequacy of the offshore accommodation modules for fire resistance can only be assessed on an individual basis and the duty holder should be required to justify that the applied standard/code will be equally effective. Relevant Legislation, ACOP and Guidance includes: Offshore Installations (Safety Case) Regulations 2005 Offshore Installations (Prevention of Fire and Explosion, and Emergency Response) Regulations 1995 Electricity at Work Regulations 1989 Provision and Use of Work Equipment Regulations 1998 Operational Circular OC 217/2 (Rev) Fire Legislation and Liaison between HSE Inspectors and Fire Authorities Guidance on General Fire Precautions at Premises subject to Fire Certificates (Special Premises) Regulations 1976 4. Specific Technical Issues: Provision for water sprinklers systems; fire resistant walls and self-closing fire doors should be evaluated as well as procedural measures such as no smoking in bedrooms. Risk evaluation of accommodation fires should be based on a standard fire assessment methodology that is, ignition sources, fire detection, fire loads, compartmentalisation, fire barriers, use of non-toxic materials, protections systems etc.
3.
249
5.
Other Related Assessment Sheets in this Section are: 9.HS2 9.HS3 9.HS4 Cellulosic Fires Electrical Fires Non Process Fires
6.
7.
8.
250
9.HS2:
Introduction
Cellulosic Fires
Cellulosic fires are fires that result from the combustion of solid materials such as wood, cloth, paper etc. These fires are found predominantly in accommodation spaces, including the control room, laundry and TR. 1. Confirmation should be obtained that cellulosic fires have been assessed in accordance with a recognised standard or code of practice. Recognised standards/codes of practice would include: BS 5839 1988 Fire detection and alarm systems for buildings ISO 13702:1999 Petroleum and Natural Gas Industries Control and Mitigation of Fires and Explosions on Offshore Production Installations Requirements and Guidelines. SI 1991/2768 The Building Regulations 2. Where a standard/code of practice other than those listed above has been employed, judgement as to the adequacy can only be assessed on an individual basis, and the duty holder should be required to justify why its procedures/practices in the relevant areas will deliver an equivalent level of health and safety performance. Relevant Legislation, ACOP and Guidance includes: Offshore Installations (Safety Case) Regulations 2005 Offshore Installations (Prevention of Fire and Explosion, and Emergency Response) Regulations 1995 4. Specific Technical Issues: None 5. Other Related Assessment Sheets in this Section are: 9.HS1 9.HS3 6. Accommodation Fires Electrical Fires
3.
7.
8.
251
9.HS3:
Introduction
Electrical Fires
Electrical Fires are those associated with the electrical ignition and the combustion of the special materials [eg cables] that make up electrical equipment. Electrical fires potentially introduce the additional hazard of toxic fume [HF, HCN, phosgene] resulting from the combustion process. Fires in flammable atmospheres which have an electrical ignition source are covered in Section 5.3 Loss of Containment Fire & Explosion and are not discussed here. 1. Confirmation should be obtained that electrical equipment has been designed in accordance with a recognised standard or code of practice. Where recognised standards have been used the likelihood of an electrical fire is judged to be sufficiently low as not to require further assessment. The recognised standards for the design of electrical systems offshore include: Recommendations for the Use of Electrical and Electronic Equipment for Mobile and Fixed Offshore Platforms IEE 1992 The recognised standards for electrical cables offshore include: BS 6883 Elastomer insulated cables for fixed wiring in ships and on mobile and fixed offshore units. Requirements and Test Methods. IEC 60331 [IEC 331] Tests for Electric Cables Under Fire Conditions [Flame Resistance] IEC 60332 [IEC 331] Tests on Electric Cables Under Fire Conditions [Flame Retardancy] 2. Where a standard/code of practice other than those listed above has been employed, judgement as to the adequacy of the analysis of electrical fire hazard can only be assessed on an individual basis, and the duty holder should be required to justify why its procedures/practices in the relevant areas will deliver an equivalent level of health and safety performance. Relevant Legislation, ACOP and Guidance includes: Offshore Installations (Safety Case) Regulations 2005 Offshore Installations (Prevention of Fire and Explosion, and Emergency Response) Regulations 1995 Electricity at Work Regulations 1989 Provision and Use of Work Equipment Regulations 1998 4. Specific Technical Issues: None 5. Other Related Assessment Sheets in this Section are: 9.HS1 9.HS4 6. Accommodation Fires Non Cellulosic Fires
3.
Cross-Referenced Sections and Sheets are: Sheet 5.3.F9 Thermal Flux, Smoke Obscuration Effects
252
Sheet 5.3.F10 Sheet 5.3.F23 Sheet 5.3.F24 Sheet 5.3.F25 Sheet 5.3.F26 Sheet 5.3.F27 7.
Fire Modelling Fire/Smoke/Gas/Flame Detectors/Alarms Fire Walls Passive Fire Protection [PFP] Resistant Temporary Refuges Deluge and Sprinklers
Lead Assessment Section for this Sheet: OSD3.5 in close liaison with OSD3.2
8.
253
9.HS4:
Introduction
Non Cellulosic Fires
Non-process fires and explosions typically involve helifuel, methanol, diesel, TEG, and compressed gas cylinders. 1. Confirmation should be obtained that non process fires have been analysed in accordance with a recognised standard or code of practice. Recognised standards/codes of practice would include: ISO/FDIS 13702 Petroleum and Natural Gas Industries Control and Mitigation of fires and explosions on offshore production installations Requirements and guidelines 2. Where a standard/code of practice other than those listed above has been employed, judgement as to the adequacy of the assessment can only be assessed on an individual basis, and the duty holder should be required to justify why its procedures/practices in the relevant areas will deliver an equivalent level of health and safety performance. Relevant Legislation, ACOP and Guidance includes: Offshore Installations (Safety Case) Regulations 2005 Offshore Installations (Prevention of Fire and Explosion, and Emergency Response) Regulations 1995 Fire, Explosion and Risk Assessment Topic Guidance, HSE website 2003 Fire and Explosion Strategy, HSE website 2004 4. Specific Technical Issues: 4.1 Where fire attack is possible protection by water deluge or shielding should have been provided [especially for Acetylene cylinders]. 4.2 Where gas/vapour detection is impractical or inefficient [ie Methanol or TEG] appropriate fire detection should have been provided. 4.3 Fire hazard control for atmospheric fuel storage facilities should take into account location, containment [bunding/scuppers] drainage, automatic fuel shut-off, passive fire protection and ventilation/ ventilation shut-off. 5. Other Related Assessment Sheets in this Section are: None 6. Cross-Referenced Sections and Sheets are: None 7. Lead Assessment Section for this Sheet: OSD3.2 8. Team Responsible for authoring and updating this sheet: OSD3.2
3.
254
10. Emergency Response

1. Scope The Offshore Installations (Safety Case) Regulations [SCR] and associated Schedules contain specific requirements for emergency response to major accident hazards on the installation. It is also necessary for the safety case to demonstrate that the emergency response arrangements ensure compliance with the relevant statutory provisions. The Offshore Installation (Prevention of Fire and Explosion, and Emergency Response) Regulations [PFEER] also interface with SCR, in particular the identification of major accidents requiring an emergency response, the organisation and management of emergency response and summarising the assessment of the emergency response arrangements. 2. Assessment of Adequacy of Demonstration
To facilitate assessment of a safety case a set of elements relating to emergency response have been defined and are set out in the following assessment sheets. This guidance covers all types of safety cases, installations, combinations of installations and operating regimes and is therefore of necessity pitched at a fairly high level. It should not therefore be regarded as restricting assessors in any way if, in their judgement, issues not explicitly covered by this guidance need to be pursued to establish the acceptability of the case for safety. Reference is made throughout this Section to industry codes, standards and guidance. This should not be interpreted as conferring any status to such material in terms of achieving legislative compliance. Therefore, complying with UKOOA documents does not guarantee a duty holder will comply with the Regulations or will provide all the information required by assessors in a safety case. Where industry codes, standards or guidance are employed in arguments supporting the case for safety, their relevance to the particular circumstances of the installation in question should be established in the safety case together with an indication as to how compliance of the duty holders arrangements with this material is achieved. 3. Depth of Assessment
Assessment of a duty holders emergency response arrangements is targeted primarily at determining whether or not the performance of the arrangements made to secure an effective emergency response is credible and effective. Verifying whether or not the emergency response arrangements are physically capable of delivering the claimed performance is a matter for post acceptance inspection. While it is a matter of balance as to how much material is required in a safety case rather than verified through inspection, any discussion included in a safety case in support of a demonstration of regulatory compliance should contain sufficient detail to lend conviction to the arguments. Further, the assessment of safety cases is basically a sampling process. Therefore, dependent upon a number of factors including assessment history, not all the elements identified in this Section may necessarily be assessed in every safety case assessment. Lastly, it should be noted that this material is only relevant to safety case assessment and is not sufficient to determine full compliance with PFEER. Assessment Sheets The subdivision of emergency response into assessment sheets for the purposes of safety case assessment is shown in Table 1.
255
Table 1 Sheet No 10.F1 10.F2 10.F3 10.F4 10.F5 10.F6 10.F7 10.F8 10.F9 10.F10 Sheet Title Emergency Response Management Alarms and Communication Temporary Refuge and Muster Stations Access/Egress Routes Evacuation Escape Rescue and Recovery Ship Collision Emergency Lighting Emergency Communications
256
10.F1:
Introduction
Emergency Response Management
The adequacy of the management of emergency response and the contribution this makes to the demonstration that major accident hazard risks have been reduced to comply with PFEER provisions is considered. Aspects of emergency response included in this assessment sheet are the emergency response plan [ERP] and adverse weather policy, the assessment of the emergency response arrangements and the competence of those involved in executing the ERP. 1. Confirmation should be obtained that a recognised code, standard or body of guidance has been taken into account in determining the required performance of the emergency response management. Recognised codes, standards or guidance include: UKOOA Industry Guidelines for the Management of Emergency Response for Offshore Installations UKOOA Guidelines for The Management of Competence and Training in Emergency Response COGENT [formerly OPITO] Offshore Emergency Response Standards. Assessment Principles for Offshore Safety Cases [APOSC] 2. Where a standard/code of practice other than those listed above has been employed, judgement as to the adequacy of the emergency response management can only be assessed on an individual basis and the duty holder should be required to justify why its approach will deliver an equivalent level of health and safety. Relevant Legislation, ACOP and Guidance includes: Offshore Installations (Safety Case) Regulations 2005 Offshore Installations (Prevention of Fire and Explosion, and Emergency Response) Regulations 1995 4. Specific Technical Issues: The safety case should include information on the following topics:
3.
Identification of major accident hazards for which an emergency response is required. Maximum number of people for which the case for safety is being made and their likely distribution around the installation for all operational modes. Emergency response strategy associated with each type of identified major accident hazard and how the strategy has incorporated the effects of adverse and exceptional weather. Organisation and management of emergency response both on the installation and beyond in sufficient detail to show how an effective emergency response is achieved. Contribution to the reduction of major accident risks made by the emergency response arrangements.
257

5.
Competence and training of all those involved in executing the Emergency Response Plan. Remedial action plans in relation to measures that are intended to be implemented. Verification that the emergency response arrangements are, and remain, effective.
Other Related Assessment Sheets in this Section are: 10.F2 10.F3 10.F4 10.F5 10.F6 10.F7 10.F8 Alarms and Communications Temporary Refuge & Muster Stations Access/Egress Routes Evacuation Escape Rescue and Recovery Ship Collision
6.
7.
8.
258
10.F2:
Introduction
Alarms and Communication
The Safety Case Regulations require information on the arrangements for protecting persons from hazards of explosion, fire, heat, smoke, toxic gas or fumes. Alarm and communication arrangements form part of such arrangements. It should be noted that the assessment of the electrical aspects of alarms and communications are outwith the scope of this assessment sheet. 1. Confirmation should be obtained that a recognised code, standard or body of guidance has been taken into account in determining the required performance of the emergency response management. Recognised codes, standards or guidance include: UKOOA Industry Guidelines for the Management of Emergency Response for Offshore Installations UKOOA Guidelines for The Management of Competence and Training in Emergency Response COGENT [formerly OPITO] Offshore Emergency Response Standards. 2. Where a standard/code of practice other than those listed above has been employed, judgement as to the adequacy of the emergency response management can only be assessed on an individual basis and the duty holder should be required to justify why its approach will deliver an equivalent level of health and safety. Relevant Legislation, ACOP and Guidance includes: Offshore Installations (Safety Case) Regulations 2005 Offshore Installations (Prevention of Fire and Explosion, and Emergency Response) Regulations 1995 Assessment Principles for Offshore Safety Cases [APOSC] 4. Specific Technical Issues: The safety case should include information on the following topics:
3.
Arrangements made for emergency alarm signs, signals and communications as prescribed by the PFEER Regulations. The safety case should contain sufficient information to show that regulation 11 of PFEER is met The role of voice communications systems in directing personnel to a particular course of action during the various phases of an emergency
5.
Other Related Assessment Sheets in this Section are: 10.F1 10.F3 10.F4 10.F5 10.F6 10.F7 Emergency Response Management Temporary Refuge & Muster Stations Access/Egress Routes Evacuation Escape Rescue and Recovery
259
10.F8 6.
Ship Collision
7.
8.
260
10.F3:
Introduction
Temporary Refuge and Muster Stations
The arrangements for the Temporary Refuge [TR] should provide sufficient protection to enable the full POB to muster safely, permit the emergency to be assessed, monitored and controlled or limited if possible and to allow the appropriate parts of the Emergency Response Plan to be executed. The assessment of TR impairment frequency and human vulnerability is outwith the scope of this Section. 1. Confirmation should be obtained that a recognised code, standard or body of guidance has been taken into account in determining the required performance of the TR and muster stations. Recognised codes, standards or guidance include: UKOOA Industry Guidelines for the Management of Emergency Response for Offshore Installations 2. Where a standard/code of practice other than those listed above has been employed, judgement as to the adequacy of the TR and muster stations performance can only be assessed on an individual basis and the duty holder should be required to justify why its approach will deliver an equivalent level of health and safety. Relevant Legislation, ACOP and Guidance includes: Offshore Installations (Safety Case) Regulations 2005 Offshore Installations (Prevention of Fire and Explosion, and Emergency Response) Regulations 1995 Assessment Principles for Offshore Safety Cases [APOSC] 4. Specific Technical Issues: The safety case should include information on the following topics:
3.
Location and extent of the primary, and any secondary, TR. TR impairment due to temperature, CO, CO2, O2, H2S, smoke etc; levels at which actions may be initiated, means of monitoring and actions to be taken. Required endurance time for TR and muster stations for all identified major accident hazards should be specified and justified together with a description of any associated protection systems. Incidents which do not require use of the TR should be identified and justified, together with alternative mustering arrangements. Systems which will ensure that the incident can be monitored, controlled and the emergency response plan implemented. Quantities and type of PPE located at the TR and muster stations.

5.
Other Related Assessment Sheets in this Section are: 10.F1 10.F2 Emergency Response Management Alarms and Communication
261
10.F4 10.F5 10.F6 10.F7 10.F8 6.
Access/Egress Routes Evacuation Escape Rescue and Recovery Ship Collision
7.
8.
262
10.F4:
Introduction
Access/Egress Routes
Arrangements should be in place for ensuring sufficient designated routes are available from all work sites on the installation to the TR/muster areas/evacuation points and from these areas to the various means of evacuation and escape for as long as they are needed. 1. Confirmation should be obtained that a recognised code, standard or body of guidance has been taken into account in determining the required performance of the access/egress routes. Recognised codes, standards or guidance include: UKOOA Industry Guidelines for the Management of Emergency Response for Offshore Installations 2. Where a standard/code of practice other than those listed above has been employed, judgement as to the adequacy of the TR and muster stations performance can only be assessed on an individual basis and the duty holder should be required to justify why its approach will deliver an equivalent level of health and safety. Relevant Legislation, ACOP and Guidance includes: Offshore Installations (Safety Case) Regulations 2005 Offshore Installations (Prevention of Fire and Explosion, and Emergency Response) Regulations 1995 Assessment Principles for Offshore Safety Cases [APOSC] 4. Specific Technical Issues: The safety case should include information on the following topics:
3.
The philosophy of access/egress routes provision. Number and location of access/egress routes from all the potential work sites on the installation to the temporary refuge/muster stations/ evacuation and escape points should be shown diagrammatically. The impairment criteria and required endurance time for all routes. Sufficient information should be included to justify how the specified endurance times will be achieved taking into account the preference to protect routes rather than individuals. PPE [type and quantity] available for use with the above routes. Arrangements in the event of impairment of primary access/egress routes.

5.
Other Related Assessment Sheets in this Section are: 10.F1 10.F2 10.F3 10.F5 10.F6 Emergency Response Management Alarms and Communication Temporary Refuge and Muster Stations Evacuation Escape
263
10.F7 10.F8 6.
Rescue and Recovery Ship Collision
7.
8.
264
10.F5:
Introduction
Evacuation
Evacuation encompasses arrangements and plant on and beyond the installation. These include provision of primary and secondary means of evacuation, eg helicopter, TEMPSC, sea transfer and bridge-link; some necessitating arrangements with others. Specific consideration is required of the availability, redundancy and diversity of the various means. 1. Confirmation should be obtained that a recognised code, standard or body of guidance has been taken into account in determining the required performance of the evacuation performance. Recognised codes, standards or guidance include: UKOOA Industry Guidelines for the Management of Emergency Response for Offshore Installations OTO Report 02 021 Compatibility Test Protocol for Life Jackets and Immersion Suits on Offshore Installations 2. Where a standard/code of practice other than those listed above have been employed, judgement as to the adequacy of the evacuation arrangements can only be assessed on an individual basis and the duty holder should be required to justify why its approach will deliver an equivalent level of health and safety. Relevant Legislation, ACOP and Guidance includes: Offshore Installations (Safety Case) Regulations 2005 Offshore Installations (Prevention of Fire and Explosion, and Emergency Response) Regulations 1995 Assessment Principles for Offshore Safety Cases [APOSC] 4. Specific Technical Issues: The safety case should include information on the following topics:
3.
The philosophy behind the selection, hierarchy, redundancy, diversity and distribution of the means of evacuation and demonstrate that the arrangements ensure, so far as is reasonably practicable, the safe evacuation of all persons. Each means of evacuation in terms of number, size, capacity, location, orientation, limitations in use, means of deployment/boarding, and in the case of TEMPSC crewing and speed. Means of communication available to control stations and means of evacuation. The philosophy behind the selection and distribution of PPE which should take account of persons who have mustered directly at the evacuation point as well as those mustering at their own normal muster station. Emergency lighting arrangements at evacuation points. Arrangements to be made with others beyond the installation. The identification of those major accident hazards and other events which impair the evacuation arrangements.
265
The time for which the evacuation point and means of evacuation is required to be available. Means of impairment, impairment criteria, any means of protection and alternative arrangements to accommodate such impairment. Compatibility between the means of evacuation and any PPE.
5.
Other Related Assessment Sheets in this Section are: 10.F1 10.F2 10.F3 10.F4 10.F6 10.F7 10.F8 Emergency Response Management Alarms and Communication Temporary Refuge and Muster Stations Access/Egress Routes Escape Rescue and Recovery Ship Collision
6.
7.
8.
266
10.F6:
Introduction
Escape
The distinction between the processes of evacuation and escape had not been established at the time SCR originally came into force. This distinction was introduced by PFEER and two separate Regulations [15 and 16] set out the requirements that the duty holder must satisfy in these areas. For the purpose of safety case assessment the escape arrangements may be regarded as a subset of the evacuation arrangements intended to ensure, so far as is reasonably practicable, a safe means for all persons to leave the installation in an emergency that has also involved a failure in the principal evacuation arrangements. 1. Confirmation should be obtained that a recognised code, standard or body of guidance has been taken into account in determining the required performance of the escape arrangements. Recognised codes, standards or guidance include: UKOOA Industry Guidelines for the Management of Emergency Response for Offshore Installations OTO Report 02 021 Compatibility Test Protocol for Life Jackets and Immersion Suits on Offshore Installations 2. Where a standard/code of practice other than those listed above has been employed, judgement as to the adequacy of the escape arrangements can only be assessed on an individual basis and the duty holder should be required to justify why its approach will deliver an equivalent level of health and safety. Relevant Legislation, ACOP and Guidance includes: Offshore Installations (Safety Case) Regulations 2005 Offshore Installations (Prevention of Fire and Explosion, and Emergency Response) Regulations 1995 Assessment Principles for Offshore Safety Cases [APOSC] 4. Specific Technical Issues:
3.
The philosophy behind the selection, hierarchy, redundancy, diversity and distribution of the means of escape will ensure, so far as is reasonably practicable, the escape of all persons. Such philosophy should differentiate between mass means of escape, such as could occur upon unavailability of the TEMPSC, and individual escape necessitated by having become isolated from the means of evacuation. Each means of escape in terms of number, size, capacity, location, limitations in use, and means of deployment/boarding. The philosophy behind the selection and distribution of PPE which should take account of persons who have gone directly to an escape point. Emergency lighting arrangements at escape points. The time for which the escape point and means of escape is required to be available. Compatibility between the means of escape and any PPE.
267
5.
Other Related Assessment Sheets in this Section are: 10.F1 10.F2 10.F3 10.F4 10.F5 10.F7 10.F8 Emergency Response Management Alarms and Communication Temporary Refuge and Muster Stations Access/Egress Routes Evacuation Rescue and Recovery Ship Collision
6.
7.
8.
268
10.F7:
Introduction
Rescue and Recovery
Rescue and recovery arrangements and their required performance should be summarised in safety cases as part of both Regulation 12(1), Schedule 2 para 10, Schedule 3 para 7 and Schedule 5 para 5 requirements. Such summary need only address major accident hazards although the actual arrangements should also provide for those entering the sea either as a result of a helicopter ditching on landing or take-off or an overside working incident. 1. Confirmation should be obtained that a recognised code, standard or body of guidance has been taken into account in determining the required performance of the rescue and recovery arrangements. Recognised codes, standards or guidance include: UKOOA Industry Guidelines for the Management of Emergency Response for Offshore Installations OTO Report 02 021 Compatibility Test Protocol for Life Jackets and Immersion Suits on Offshore Installations UKOOA Guidelines for the Survey of Vessels Standing by Offshore Installations UKOOA Guidelines for the Safe Management and Operation of Vessels Standing by Offshore Installations 2. Where a standard/code of practice other than those listed above have been employed, judgement as to the adequacy of the rescue and recovery arrangements can only be assessed on an individual basis and the duty holder should be required to justify why its approach will deliver an equivalent level of health and safety. Relevant Legislation, ACOP and Guidance includes: Offshore Installations (Safety Case) Regulations 2005 Offshore Installations (Prevention of Fire and Explosion, and Emergency Response) Regulations 1995 Assessment Principles for Offshore Safety Cases [APOSC] 4. Specific Technical Issues: The safety case should include information on the following topics:
3.
Selection of the scenarios for which rescue and recovery is required, eg evacuation or escape, man overboard and helicopter ditch, and selection of the rescue and recovery arrangements to accommodate the selected scenarios. A summary of the arrangements for effecting rescue and recovery for each of the scenarios including any sharing arrangement between different installations. Performance Standards for rescue and recovery which should include the numbers of persons associated with each scenario, their survival times and the total recovery times to an identified place of safety. PPE required to achieve the quoted survival times. Any equipment provided to assist location of survivors.
269

5.
Weather limits on the rescue and recovery arrangements and actions to be taken when these are exceeded.
Other Related Assessment Sheets in this Section are: 10.F1 10.F2 10.F3 10.F4 10.F5 10.F6 10.F8 Emergency Response Management Alarms and Communication Temporary Refuge and Muster Stations Access/Egress Routes Evacuation Escape Ship Collision
6.
7.
8.
270
10.F8:
Introduction
Ship Collision
Ship collision is a major accident hazard. It should be noted that this assessment sheet relates to passing/drifting vessels. Risks due to attendant vessels are addressed in Section 2 Vessel Impact. 1. Confirmation should be obtained that a recognised code, standard or body of guidance has been taken into account in determining the required performance of the ship collision avoidance arrangements. Recognised codes, standards or guidance include: UKOOA Guidelines for Ship/Installation Collision Avoidance UKOOA Guidelines for the Management of Emergency Response for Offshore Installations 2. Where a standard/code of practice other than those listed above has been employed, judgement as to the adequacy of the ship collision avoidance arrangements can only be assessed on an individual basis and the duty holder should be required to justify why its approach will deliver an equivalent level of health and safety. Relevant Legislation, ACOP and Guidance includes: Offshore Installations (Safety Case) Regulations 2005 Offshore Installations (Prevention of Fire and Explosion, and Emergency Response) Regulations 1995 Assessment Principles for Offshore Safety Cases [APOSC] 4. Specific Technical Issues: The safety case should include information on the following topics:
3.
5.
Performance standards stating the required warning time and relating this to the time needed to implement the emergency response plan.
Other Related Assessment Sheets in this Section are: 10.F1 10.F2 10.F3 10.F4 10.F5 10.F6 10:F7 Emergency Response Management Alarms and Communication Temporary Refuge and Muster Stations Access/Egress Routes Evacuation Escape Rescue & Recovery
6.
7.
Lead Assessment Section for this Sheet:
271
OSD3.3 8. Team responsible for authoring and updating this sheet: OSD3.3
272
10.F9:
1.
Emergency Lighting
Confirmation should be obtained that the emergency lighting has been designed in accordance with a recognised standard or code of practice. Recognised current standards/codes of practice would include: BS 5266 Emergency Lighting The Chartered Institution of Building Services Application Guide: Lighting in Hostile and Hazardous Environments Regulations laid down by the Norwegian Maritime Directorate (1992) Regulations for Mobile Offshore Units Lloyds, DNV and ABS Classification Rules: Mobile Offshore Units IMO Code for the Construction and Equipment Of Mobile Offshore Drilling Units [MODU Code] International Convention for the safety of life at sea SOLAS BS IEC 61892 Mobile and Fixed Offshore Units Electrical Installations EN1838 [equivalent to BS 5266 Part 7] Lighting Application Emergency Lighting BSEN 50172 Emergency Escape Lighting Systems ICEL 1006: Emergency Lighting Design Guide The above codes, standards and guidance collectively cover the layout of all types of installation [fixed, FPSO and MODUs]. However they are particularly pertinent to the design of new installations and therefore are likely to be referenced in design safety cases.
2.
Where a standard/code of practice other than those listed above has been employed, judgement as to the adequacy of emergency lighting can only be assessed on an individual basis, and the duty holder should be required to justify why its procedures/practices in the relevant areas will deliver an equivalent level of health and safety performance. Relevant Legislation, ACOP and Guidance includes: Offshore Installations (Safety Case) Regulations 2005, Schedule 2 para 12 and Schedule 3 para 9 Offshore Installations (Prevention of Fire and Explosion, and Emergency Response) Regulations 1995, Regulation 14 para 141 The following Regulation is applicable to hazardous areas of fixed installations but does not apply to MODUs, floating production platforms [FPPs] and floating production storage and offloading vessels [FPSOs]. Equipment and Protective Systems Intended for Use in Potentially Explosive Atmospheres Regulations 1996
3.
4.
Specific Technical Issues: The safety case should include:
273
4.1 Details of the means of affording emergency lighting in the temporary refuge, from the temporary refuge from normal places of work, from the temporary refuge to evacuation points and at evacuation points. 4.2 Evidence of the adequacy of illumination provided by each emergency lighting system installed and the periods for which they are each maintained. 4.3 An analysis of the vulnerability of the emergency lighting systems to their operating environment and to damage from a major accident [ie protection against the effects of explosion, fire, missiles etc.] 4.4 Details of emergency lighting within hazardous areas or emergency lighting that is required to remain live in emergency conditions regardless of location. Emergency lighting fittings for such areas should be or may have been designed in accordance with BS 5501 or BS EN 50014 and selected, installed and maintained in accordance with BS 5345 or BS EN 60079 series of standards. 5. Other Related Assessment Sheets in this Section are: 10.F3 10.F4 10.F5 10.F6 6. Temporary Refuge and Muster Stations Access/Egress Routes Evacuation Escape
Cross-Referenced Sections and Sheets are: Sheet 5.3.F21 Electrical Equipment for Use in Potentially Flammable Atmospheres
7.
8.
274
10.F10:
Introduction
Emergency Communications
The requirement for emergency communications is detailed in PFEER. Communication for health and safety purposes is detailed in the Offshore Installations and Pipeline Works (Management and Administration) Regulations [MAR]. In summary, the requirements for emergency communications are to have sufficient and diverse means and arrangements for communicating with personnel on the installation and appropriate external bodies. [This assessment sheets covers all these elements]. It is desirable that as many as possible of the telecommunications systems provided for normal operation, and which can perform useful service in controlling the emergency, should remain active, provided that their continued operation does not create additional hazards. Communicating with Personnel on the Installation The following objectives are to be achieved for communicating with personnel on the installation: To enable persons controlling the emergency to alert all personnel on the installation, instruct them as required including to proceed to muster stations, and, where appropriate, to evacuate the installation. To enable persons in charge of muster stations to communicate with each other, and with the Emergency Control Centre [ECC] on the installation. To enable members of emergency work teams attempting to bring the situation under control to communicate with each other, and with the ECC. To enable persons who may be trapped by the incident in an area of the installation from which they cannot reach their muster stations to communicate with the ECC. To enable the ECC on the installation to call for external assistance, and to communicate with an Onshore Emergency Response Control. Communicating with External Parties The following objectives are to be achieved for communicating with external parties: To enable the ECC on the installation to call for external assistance, and to communicate with an Onshore Emergency Response Control. To enable the ECC to communicate with other nearby offshore installations, where applicable, which may be able to provide assistance. To enable the ECC to communicate with any vessel standing by the installation and other ships in the vicinity, which may be involved in efforts to control the emergency situation, or in rescue operations. To enable the ECC and helicopter landing officer to communicate with helicopters involved in evacuation and rescue operations. To enable TEMPSC to communicate with ships and helicopters in the vicinity. To communicate with aircraft involved in an emergency [eg Search and Rescue On Scene Commander]. Systems to achieve the above objectives include:
275
Public address system General alarm system Hand portable radio units [which may be used portable-to-portable direct, portable-toportable via a repeater, or base station to portable].
Marine VHF system [using fixed base-stations or hand-portable transceivers]. Platform UHF hand-portable radio system [where vessel is equipped with fixed or hand-portable units on frequencies assigned to installation]. MF radio operating at inter-ship frequencies. Inmarsat service. Aeronautical VHF system [using fixed base-stations or hand-portable transceivers].
1. Confirmation should be obtained that the emergency communications has been designed in accordance with a recognised standard or code of practice. Recognised current standards/codes of practice would include: CP043 1996 Issue No 2 UKOOA Guidelines for Safety Related Telecommunications Systems On Normally Attended Fixed Offshore Installations CP044 1996 Issue No 2 UKOOA Guidelines for Safety Related Telecommunications Systems On Normally Unattended Fixed Offshore Installations BS 7443 (1991) Specification for Sound Systems for Emergency Purposes BS EN 60849 (1998) Sound Systems for Emergency Purposes BS EN 60268-16 (2003) Sound Systems Equipment Regulations laid down by the Norwegian Maritime Directive (1992) Regulations for Mobile Offshore Unit Lloyds, DNV and ABS Classification: Mobile Offshore Units IMO Code for the Construction and Equipment Of Mobile Offshore Drilling Units (MODU Code) International Convention for the safety of life at sea SOLAS CAP 437 Civil Aviation Authority The above codes, standards and guidance collectively cover the layout of all types of installation [fixed, FPSO and MODUs]. However they are particularly pertinent to the design of new installations and therefore are likely to be referenced in design safety cases. 2. Where a standard/code of practice other than those listed above has been employed, judgement as to the adequacy of emergency communications can only be assessed on an individual basis, and the duty holder should be required to justify why its procedures/practices in the relevant areas will deliver an equivalent level of health and safety performance. Relevant Legislation, ACOP and Guidance includes:
3.
276
Offshore Installations (Safety Case) Regulations 2005, Schedule 2 para 12 and Schedule 3 para 9 Offshore Installations (Prevention of Fire and Explosion, and Emergency Response) Regulations 1995, Regulation 14 para 145 Offshore Installations (Prevention of Fire and Explosion, and Emergency Response) Regulations 1995, Regulation 11 para 107-115 Offshore Installations and Pipeline Works (Management and Administration) Regulations 1995, Regulation 12 The following Regulation is applicable to hazardous areas of fixed installations but does not apply to MODUs, floating production platforms [FPPs] and floating production storage and offloading vessels [FPSOs]. Equipment and Protective Systems Intended for Use in Potentially Explosive Atmospheres Regulations 1996 Merchant Shipping (Radio Communications) Regulations 1998 [Note GMDSS not enforced by HSE] 4. Specific Technical Issues: 4.1 UKOOA Guidelines for Safety Related Telecommunications Systems on Normally Attended Fixed Offshore Installations CPO43, 1996, Issue No 2 and UKOOA Guidelines for Safety Related Telecommunications on Normally Unattended and Fixed Offshore Installations CPO44, 1996, Issue No 2, Appendix A2 and A3, provides a basis for the specification of suitable emergency communication equipment. 4.2 The duty holder should be able to supply sufficient detailed information to show that PFEER Regulation 11 is met. 4.3 The requirements for alarm and PA functions are: i. ii. Provision of an audible and/or visual emergency warning, to all persons on the installation. Provision of emergency communications between persons on the installation.
These are normally an audible and visible alarm system and an intelligible system that in an emergency situation would be required to function as follows: i. ii. iii. iv. Provide the alarm signal and continue to operate as far as possible throughout the emergency. Alert personnel in the accommodation cabin and work area by audible alarms. Provide verbal information to personnel on their way to muster/ embarkation points. Provide command and control at muster and embarkation points.
The safety case should recognise the importance of both audible and visible alarms and voice communications system. 4.4. GMDSS is an international system which uses terrestrial and satellite technology and ship board radio systems to ensure rapid, automated, alerting of shore based
277
communication and rescue authorities, in addition to ships in the immediate vicinity in the event of a marine distress. GMDSS applies to vessels which would include those mobile installations registered as vessels. All offshore installations that operate on the UKCS are required to comply with PFEER. These Regulations require that amongst other things the duty holder makes suitable arrangements for the purpose of emergency response for communication between the installation and persons beyond it. In addition to PFEER, the Offshore Installations and Pipeline Works (Management and Administration) Regulations 1995 requires under Regulation 12 that duty holders have effective communication in place to communicate between the offshore installation and the shore, vessels, aircraft and other installations. Although GMDSS is not mandatory for fixed production installations, it is mandatory for all other maritime mobiles including support and supply vessels, semi submersible, mobile jack-up drilling rigs. There is therefore a decision to be made by the duty holder, as to whether a duty holder would choose to implement GMDSS as part of its safety case. Factors influencing this decision may include: Location: Remoteness Proximity to VHF Coastal Radio Station Proximity to Sea Lanes Field operations philosophy. 5. Other Related Assessment Sheets in this Section are: 10.F3 10.F4 10.F5 10.F6 6. Temporary Refuge and Muster Stations Access/Egress Routes Evacuation Escape
Cross-Referenced Sections and Sheets are: Section 2 Vessel Impact
Sheet 5.3.F21Electrical Equipment for Use in Potentially Flammable Atmospheres 7. Lead Assessment Section for this Sheet:
OSD3.5
8.
278
11. HUMAN FACTORS

1. Scope The topic area of Human Factors covers three broad areas: human error; procedural integrity; and organisational integrity. The twelve elements shown in the table below subdivides these into practical assessment sheets that are underpinned by regulation and relate to key offshore safety issues, for both assessment and inspection. It must be stressed however, that the designation of these sheets is focused on the assessment of safety cases as per the Offshore Installations (Safety Case) Regulations 2005 (SCR), rather than PFEER assessment, to which the sheets relate only insofar as SCR require a description of how the duty holder has, or will ensure, compliance with regulation 4(1) of PFEER within the safety case. There are numerous interfaces and overlaps with other sections: eg Emergency Response and Risk Analysis; and where these associations exist, the overlap and demarcated areas of assessment are explained. Of particular interest is the emphasis of the human factors involved in the earlier conceptual design stages of the installation lifecycle. This reflects the increasing realisation that the human element involved in professional judgement is of equal, if not greater, significance than the hazard and risk analysis methodologies themselves in deriving realistic decisions on ALARP, SFAIRP and acceptability in general. Human error is considered in the operational scenario, but the assessment approach is to consider the pressures and influences on the individual brought by organisational culture and factors, contractualisation, multi-skilling/tasking, and competence and task analysis, and the ultimate effect this has in impairing human performance. Procedural assessment is similarly sub-divided into Permit to Work systems [11.G7] and organisational change management [11.G9], as they have sufficient content to be assessment sheets in their own right. Finally, it must be re-emphasised that the focus of human factors assessment is the risk and measures associated with human reliability in an acute sense, where this constitutes a causal factor in the development of major accident scenarios. Starting with the individual, we pan out to look at the procedural frameworks and the organisational context [with associated pressures] that influence human performance. We are not concerned with the chronic effect of the work environment upon the health of the individual - it is the safety effects of human performance - or more significantly human failure - that is of concern in assessment.
279
11.G1:
Introduction
Human Error: Selection, Competence and Training
This sheet considers the arrangements for ensuring the competence of individuals to perform to an acceptable standard in given tasks and roles. In the first instance, this is influenced by appropriate test and selection procedures, but thereafter invokes the need for structured and systematic training for such tasks and roles, particularly where these are directly safety-critical. Once these measures can be demonstrated, this sheet also considers on-going competence assessment for such tasks and roles. The duty holder may operate team based working, never the less each individual team member must be competent to undertake safely the tasks they are likely to be required to do. 1. Confirmation should be obtained that a procedure is in place for the selection, competence assessment, and training of operations and maintenance personnel and that it is designed in accordance with a recognised standard or code of practice. Recognised current standards/codes of practice would include: RR 206-01-R-01 Human Factors in Offshore Operations: Role evaluation tool RR 086 Competence assessment for the hazardous industries [Applicable to onshore and offshore domains] OTO 1999/092 Human factors assessment of safety critical tasks [along with RR 033: Evaluation report on OTO 1999/092] OTH 92 374 The Selection and Training of Offshore Installation Managers for Crisis Management OTO 2001/053 Preventing the propagation of errors and misplaced reliance on faulty systems; a guide to human error dependency 2. Where a standard/code of practice is listed above, and an alternative has been employed, judgement as to the adequacy of operator selection, competence, and training can only be assessed on an individual basis, and the duty holder should be required to justify why its procedures/practices in the relevant areas will deliver an equivalent level of health and safety performance. Relevant Legislation, ACOP and Guidance includes: Offshore Installations (Safety Case) Regulations 2005 including associated Schedules and guidance (L30). Specifically: Regulation 12(1)(d) - see guidance paras 176 and 177 re sufficient particulars which should be included within the case; and the associated schedules and APOSC principle 21 requirements for including the results of the PFEER regulation 5 assessment in the safety case, invokes a particular need for task/human analysis where the human is an integral part of the Safety Critical Element [SCE] under consideration. Offshore Installations (Prevention of Fire and Explosion, and Emergency Response) Regulations 1995 plus associated ACOP and guidance (L65) Assessment Principles for Offshore Safety Cases [APOSC] 4. Specific Technical Issues: Assessment within this area needs to take account of the level of independence of an individual: where specific roles require an individual from the duty holder side to be
3.
280
independent, then evidence has to be provided to support this, and the assessor has to make an informed judgement that the level of independence is adequate. Evidence needs to be provided that safety critical roles, tasks and procedures have been identified, and that these have been subjected to systematic task analysis or procedural review to ensure that all improvements [to comply with the relevant statutory provisions] have been made. As a logical follow-on, where key safety-critical roles are identified, evidence is required that there has been a capability assessment undertaken for the role. Suitable assessment might involve structured psychometric assessment/test, particularly in the case of key management tactical decision-making roles. Similarly, where key safety-critical tasks are identified, evidence is required that the simulation and test of the human and team capability has been assessed adequate for the task. Inspection indicators: Duty holder procedures re selection, competence, training; team/individual task analysis; PFEER verification - human as SCE. 5. Other Related Assessment Sheets in this Section are:
11.G2 Human Error: Stress, Fatigue, Shifts and Organisational Factors
11.G4 6.
ALARP & SFAIRP Awareness
Cross-Referenced Sections and Sheets are: Section 2 Section 5.1 Sheet 5.1.HS1 Section 7 Sheet 7.F1-F3 Section 8 Sheet 8:F16 Vessel Impact Loss of Containment - Process Pressure Vessels [Including Columns] Diving Risk Evaluation [Likelihood Factors] Helicopter Crash Competent Personnel Client Review/Acceptance of Procedures [See sheet 8.F10-F20]
7.
8.
281
11.G2:
Introduction
Human Error: Stress, Fatigue, Shifts and Organisational Factors
Assessment needs to take account of external factors that can compromise individual performance of task or role, quite apart from competence. Such factors include stress, fatigue, shift patterns, and organisational factors, including company culture [although this may be difficult to elicit from a safety case]. 1. Confirmation should be obtained that due consideration and assessment of external factors, in terms of stress and organisational pressure, has been conducted in accordance with a recognised standard or code of practice. Confirmation should be obtained that means are provided for managing and maintaining the alertness of staff engaged in hazardous or high consequence activities. Relevant Standards, ACOPS, Guidance [HSE and industry], and preliminary guidance [HSE research reports and internal guidance, to be formalised] are as follows: HSG 48 Reducing error and influencing behaviour [Applicable to all forms of installation] HSG 65 Successful health and safety management [Applicable to all forms of installation] RR 107 Development of internal company standards of good management practice and task-based risk assessment tool for offshore work related stress INDG 281 HSE Help on work related stress RR 133 Beacons of excellence in Stress Prevention [Guidance in progress] SPC Shiftwork offshore SPC stress in high hazard industries 2. Where a standard/code of practice is listed above, and an alternative has been employed, judgement as to acceptability of risk, and procedures to control these risks, can only be assessed on an individual basis, and the duty holder should be required to justify why its provision in this area will deliver an equivalent level of health and safety performance. Relevant Legislation, ACOP and Guidance includes: Offshore Installations (Safety Case) Regulations 2005 including associated Schedules and guidance (L30). Specifically: Regulation 12(1)(d) - see guidance paras 176 and 177 re sufficient particulars which should be included within the case; and the associated schedules and APOSC principle 21 requirements for including the results of the PFEER regulation 5 assessment in the safety case, invokes a particular need for consideration of human vulnerability to stress/fatigue-induced error, where the human is an integral part of the safety critical element [SCE] under consideration. Offshore Installations (Prevention of Fire and Explosion, and Emergency Response) Regulations 1995 plus associated ACOP and guidance (L65) Assessment Principles for Offshore Safety Cases [APOSC] 4. Specific Technical Issues:
3.
282
Where specific roles require an individual from the duty holder side to be independent, then evidence has to be provided to support this. This is crucial to the assessment of risks, and their associated control measures, as compromise of independence is, in itself, a stressor, and can bring inappropriate pressure to decision-making. Assessment of the stress/organisational hazard needs to have been conducted, as well as its potential realisation in the risk and consequences of human error. This indicates a need for a level of individual profiling for stress-vulnerability to have been conducted, in a climate of organisational support, particularly where safety-critical activity is concerned. Inspection links: Compliance audit/verification; organisational factors - particularly independence; safety culture; independent audit and interview of duty holder staff. 5. Other Related Assessment Sheets in this Section are: 11.G4 11.G6 11.G10 6. ALARP & SFAIRP Awareness Procedural Integrity Knowledge Management
Cross-Referenced Sections and Sheets are: Section 2 Section 5.1 Sheet 5.1.HS1 Section 7 Section 8 Sheet 8.F16 Vessel Impact Loss of Containment - Process Pressure Vessels [Including Columns] Diving Helicopter Crash Competent Personnel Client Review/Acceptance of Procedures [see 8.F10 F20]
7.
8.
283
11.G3:
Introduction
Human Error in Design
Human factors (HF) feature at all phases of the installation lifecycle from inception through to dismantling. From the outset, we are concerned about human error at the initial strategic and planning stages, and concept development, particularly the capture of requirements, and any potential mismatch between design and operational function. Consequently, there is more potential to eliminate hazards at the design phase than at any other time. The ALARP judgement is more favourable towards HF and usability changes during the design phase. 1. Confirmation should be obtained that due consideration to sources of error, in the design of an installation or part of it, have been identified, and design procedures are in place to minimise the potential for human error at this stage in an installations lifecycle. Demonstration needs to be made that this is in accordance with a recognised standard or code of practice. Relevant Standards, ACOPS, Guidance [HSE and industry], and preliminary guidance [HSE research reports and internal guidance, to be formalised] are as follows: RR054 Mutual misconceptions between designers and operators of hazardous installations OTO 2000/086 operational safety of FPSOs - initial summary report [Applicable to FPSOs] OTH 443A and OTH 443B Drill floor design; a consideration of human factors [Applicable to drilling rigs] HSG 48 reducing error and influencing behaviour [Applicable to all forms of installation] Ergonomics resource pack HSE web site [Applicable to all forms of installation] HSE Manual handling toolkit [HSE research report in process of publication] OTO 2002/001 Slips, trips and falls from height offshore OTO 2001/053 Preventing the propagation of error and misplaced reliance on faulty systems - a guide to human error dependency 2. Where a standard/code of practice is listed above, and an alternative has been employed, judgement as to the adequacy of the approach can only be assessed on an individual basis, and the duty holder should be required to justify why its procedures/practices in the relevant areas will deliver an equivalent level of health and safety performance. Relevant Legislation, ACOP and Guidance includes: Offshore Installations (Safety Case) Regulations 2005 including associated Schedules and guidance (L30). Specifically: Regulation 12(1)(d) - see guidance paras 176 and 177 re sufficient particulars which should be included within the case. Additionally the associated schedules and APOSC principle 21 requirements for including the results of the PFEER regulation 5 assessment in the safety case needs consideration of the human element in the design of Safety Critical Elements [SCEs] Offshore Installations (Prevention of Fire and Explosion, and Emergency Response) Regulations 1995 plus associated ACoP and guidance (L65). Assessment Principles for Offshore Safety Cases [APOSC] 4. Specific Technical Issues:
3.
284
Where contractualisation in design has occurred, reference needs to be made to the provision for knowledge management in the design. Demonstration needs to be made by the duty holder that a full requirements analysis has been conducted to preclude designoperation misconception. 5. Other Related Assessment Sheets in this Section are: 11.G4 11.G6 11.G10 11.G11 6. ALARP & SFAIRP Awareness Procedural Integrity Knowledge Management Contractualisation: Communications and Competence
Cross-Referenced Sections and Sheets are: Section 2 Sheet 2.G1 Section 5.1 Section 13 Vessel Impact Attendant and Passing Vessels Loss of Containment - Process QRA
7.
8.
285
11.G4:
Introduction
ALARP & SFAIRP Awareness
Human error - and its minimisation - is crucial in the involvement of identification of major hazards, at the conceptual HAZOP/HAZID and preliminary risk assessment phases of the project. No matter how robust a methodology is, the greatest uncertainty at this stage is in the exercise of human judgement as to what constitutes a risk that is ALARP, or conversely a measure that is SFAIRP. We need to therefore assess carefully at the design phase to see that such human involvement is under the auspices of a robust safety management system that encompasses this phase of the installation lifecycle. 1. Confirmation should be obtained that there is sufficient consideration given to ALARP/SFAIRP principles in the formulation of the case for safety. Relevant Standards, ACOPS, Guidance (HSE and industry), and Preliminary guidance (HSE research reports and internal guidance, to be formalised) are as follows: CRR 293/2000 A comparison of accident experience and QRA methodology OTH 458 Update of the UKCS risk study Reducing risks protecting people HSE 2. Where a standard/code of practice is listed above, and an alternative has been employed, judgement as to its adequacy can only be assessed on an individual basis, and the duty holder should be required to justify why its approach will deliver an equivalent level of health and safety performance. Relevant Legislation, ACOP and Guidance includes: Offshore Installations (Safety Case) Regulations 2005 (including associated Schedules and guidance) Specifically: 12(1)(d) - see guidance paras 176 and 177 re. sufficient particulars which should be included within the case; and the associated schedules and APOSC principle 21 requirements for including the results of the PFEER regulation 5 assessment in the safety case needs consideration of the human element in the design of Safety Critical Elements (SCEs), and the net result demonstrated to show that the relevant statutory provisions have been, or will be, complied with Offshore Installations (Prevention of Fire and Explosion, and Emergency Response) Regulations 1995 plus associated ACOP and guidance Assessment Principles for Offshore Safety Cases [APOSC] 4. Specific Technical Issues: Consideration of sound technical judgement must be considered in conjunction with the appropriateness of risk analysis techniques. Independence and competence needs to be assured, of those proposing arguments on ALARP/SFAIRP. The human involvement and uncertainty associated with HAZOP/HAZID and risk assessment techniques (including QRA) needs to be assessed by considering how the safety management system controls these human processes at this stage of the lifecycle. This assessment focuses more on the management of the processes than the validity of the methods and algorithms, although both elements are inextricably linked. 5. Other Related Assessment Sheets in this Section are: 11.G3 Human Error in Design
3.
286
11.G10 6.
Knowledge Management
Cross-Referenced Sections and Sheets are: Section 2 Section 13 Vessel Impact QRA
7.
8.
287
11.G5:
Introduction
Command, Control, Communication [C3] and Decision Making
The effective performance of humans, and human interaction, under emergency conditions, is an assessment topic distinct from the physical arrangements [see Section 10] under such conditions. There is an interface with the Emergency Response Section [Section 10] in the element of procedures, but whereas physical arrangements are the domain of the EER section, OSD3.3, the human performance aspects reside with OSD3.6. With the separate, and overlapping interests so defined, we can say the following. 1. Confirmation should be obtained that a clearly-defined structure of command and control for the operation of an installation is in place, and that there is a system of communication and unambiguous decision-making for both normal and emergency conditions, with ownership, and that these comply with recognised standards or codes of practice. Recognised standards/codes of practice would include: HSG 65 Successful health and safety management HSG 48 Reducing error and influencing behaviour OTO 1999/025 Safety implications of self-managed teams OTO 1996/003 Effective shift handover - a literature review RR 135 Health and safety responsibilities of company directors and management board members RR 044 The role of managerial leadership in determining workplace safety outcomes OTH 534 Human and organisational factors in offshore safety OTH 92 374 The selection and training of Offshore Installation Managers for crisis management OTO 1999/065 Effective supervisory safety leadership behaviours in the offshore oil and gas industry OTO 2001/053 Preventing the propagation of errors and misplaced reliance on faulty systems - a guide to human error dependency 2. Where a standard/code of practice other than that listed above has been employed, judgement as to its adequacy of systems in place can only be assessed on an individual basis, and the duty holder should be required to justify why its approach will deliver an equivalent level of health and safety performance. Relevant Legislation, ACOP and Guidance includes: Offshore Installations (Safety Case) Regulations 2005 including associated Schedules and guidance (L30). Specifically: Regulation 12(1)(d) - see guidance paras 176 and 177 re sufficient particulars which should be included within the case; and the associated schedules and APOSC principle 21 requirements for including the results of the PFEER regulation 5 assessment in the safety case: need consideration of the human in the design of Safety Critical Elements [SCEs]; particularly where a C3 element is defined/declared as a SCE. Offshore Installations (Prevention of Fire and Explosion, and Emergency Response) Regulations 1995 plus associated ACOP and guidance (L65)
3.
288
Assessment Principles for Offshore Safety Cases [APOSC] 4. Specific Technical Issues: There are interfaces with sections that have responsibility for EER, marine, heliops and diving activity: these areas of interface between these crews, and the core installation crew, need to be identified and assessed for clarity, to ensure no potential hazard from either duplication/commission or omission. Inspection links: Compliance [Regulation 16]; PFEER assessment of C3 SCEs. 5. Other Related Assessment Sheets in this Section are: 11.G1 11.G2 11.G4 11.G6 11.G7 11.G8 11.G9 11.G10 11.G11 6. Human Error: Selection, Competence and Training Human Error: Stress, Fatigue, Shifts and Organisational Factors ALARP & SFAIRP Awareness Procedural Integrity Permit to Work Systems Employee Involvement Organisational Change Management Knowledge Management Contractualisation: Communications and Competence
Cross-Referenced Sections and Sheets are: Section 2 Sheet 2.G1 Section 5.1 Section 7 Section 8 Vessel Impact Attendant and Passing Vessels Loss of Containment - Process Diving Helicopter Crash
7.
8.
289
11.G6:
Introduction
Procedural Integrity
The presence of a robust structure of procedures for the key activities in the installations lifecycle must be able to be demonstrated by the duty holder. These must be within an overarching safety management system, but - in their own right - must be suitable and sufficient for purpose. PTW is of sufficient magnitude to warrant its own assessment sheet [11.G7] as are HAZOP/HAZID/RA procedures [11.G4], but all other procedural types may be dealt with in this sheet. Key amongst these are procedures for the identification of safety critical tasks and roles [complementary to the assessment of individuals in these tasks/roles [11.G1]. We also need to assess to see that there is a means of formal procedural reviews, and periodic task re-analysis. 1. Confirmation should therefore be obtained that clearly defined operational procedures are in place for all activity associated with the lifecycle of the installation, and that these comply with recognised standards or codes of practice. Recognised standards/codes of practice would include: JWP/FRD/167 Formal Procedural and Task Analysis review STEP guide to task-based risk assessment HSG 48 Reducing Error and Influencing Behaviour 2. Where a standard/code of practice is listed above, and an alternative has been employed, judgement as to the adequacy of systems in place can only be assessed on an individual basis, and the duty holder should be required to justify why its systems will deliver an equivalent level of health and safety performance. Relevant Legislation, ACOP and Guidance includes: Offshore Installations (Safety Case) Regulations 2005 including associated Schedules and guidance (L30). Specifically: Regulations 12(1)(a) - management systems and 12(1)(b) - audit Offshore Installations (Prevention of Fire and Explosion, and Emergency Response) Regulations 1995 plus associated ACOP and guidance (L65) Assessment Principles for Offshore Safety Cases [APOSC] 4. Specific Technical Issues: Diving procedural integrity is deferred to the Diving Specialist Section. HAZID/HAZOP/RA/QRA [11.G4] and PTW [11.G7] are dealt with as separate assessment topics.
3.
5.
Other Related Assessment Sheets in this Section are: 11.G1 11.G3 11.G7 Human Error: Selection, Competence and Training Human Error in Design Permit to Work systems
6.
290
Section 5.1 Section 8 7.
Loss of Containment - Process Helicopter Crash
8.
291
11.G7:
Introduction
Permit to Work Systems
Although a sub-set of the procedural assessment element within Human Factors, this is so major as to be a topic in its own right, particularly given that failure of permit to work [PTW] procedure has been a key causal factor in the major offshore accidents and incidents. 1. Confirmation should be obtained that clearly defined permit to work procedures are in place for all activities on the installation, and that these comply with a recognised standard or code of practice. Recognised standards/codes of practice would include: OIAC Permit to work guidance HSG 65 Successful Health and Safety Management HSG 48 Reducing Error and Influencing Behaviour 2. Where a standard/code of practice is listed above, and an alternative has been employed, judgement as to the adequacy of the system in place can only be assessed on an individual basis, and the duty holder should be required to justify why its system will deliver an equivalent level of health and safety performance. Relevant Legislation, ACOP and Guidance includes: Offshore Installations (Safety Case) Regulations 2005 including associated Schedules and guidance (L30). Specifically: Regulation 12(1)(d) - see guidance paras 176 and 177 re sufficient particulars which should be included within the case. Offshore Installations (Prevention of Fire and Explosion, and Emergency Response) Regulations 1995 plus associated ACOP and guidance (L65) Assessment Principles for Offshore Safety Cases [APOSC] 4. Specific Technical Issues: The issue is considered in an offshore context. Although standards exist for the onshore activity, deference should be made to the industry-supported offshore consensus guidance. Procedural integrity - in a wider context - is dealt with as a separate assessment topic [11.G6]. 5. Other Related Assessment Sheets in this Section are: 11.G1 11.G2 11.G6 11.G8 11.G9 11.G11 6. Human Error: Selection, Competence and Training Human Error: Stress, Fatigue, Shifts and Organisational Factors Procedural Integrity Employee Involvement Organisational Change Management Contractualisation: Communications and Competence
3.
292
Section 5.1 Sheet 5.1.F23 Section 7 7.
Loss of Containment - Process Isolations Diving
8.
293
11.G8:
Introduction
Employee Involvement
The engagement and involvement of the workforce of an offshore installation is essential for the operation of a health, safety and risk management system. The employees, whether in the direct employment of the duty holder, or indirectly employed by a contractor, are a key stakeholder in the offshore safety regime, who have responsibilities as well as rights under the general duty of care of the operator. The quality of employee involvement is a measure of the safety culture of a duty holder, or a specific installation, and provides a general indicator of the effectiveness of the management system in relation to an installation or its duty holder. The safety case should provide sufficient information in relation to how this involvement is implemented under the management system, such that rights, responsibilities, overall framework of health, safety and risk management is communicated to the workforce; and that issues may be communicated from workforce to management in an open and constructive manner. 1. Confirmation should be obtained that the safety case makes a full description of the modes and methods of employee involvement: directly; via safety representatives; via trade-union representatives, and with contractor organisations via their appropriate nominated individuals. Recognised standards/codes of practice would include: CRR 1996 121 Health Surveillance in Great Britain OTO 1999/025 Safety implications of self-managed teams CRR 2000/259 The effects of new ways of working on employees stress levels CRR 2000/273 Valuation of benefits of health and safety control: summary and technical report CRR 2001/393 Effective teamworking: reducing the psychosocial risks RR 042 Evaluating the effectiveness of the Health and Safety Executives Health and Safety Climate Survey Tool RR 044 The tole of managerial leadership in determining workplace safety outcomes 2. Where a standard/code of practice other than those listed above has been employed, judgement as to the adequacy of the arrangements can only be assessed on an individual basis, and the duty holder should be required to justify why its approach will deliver an equivalent level of health and safety performance. Relevant Legislation, ACoP and Guidance includes: Offshore Installations (Safety Case) Regulations 2005 including associated schedules and guidance Assessment Principals for Offshore Safety Cases [APOSC] 4. Specific Technical Issues: Evidence of compliance with the following specific statutory requirements should be provided within the safety case: (i) Management of Health and Safety at Work Regulations 1999: reg. 2 (risk assessment);
3.
294
reg. 6 (health surveillance); reg. 7 (competent persons); reg. 8 (employee procedures); reg. 10 (information); reg. 11 (cooperation and coordination); reg. 12 (self-employed employees); reg. 13 (assessment and training); reg. 14 (employees duties); reg. 15 (temporary workers):
(ii) Provision and Use of Work Equipment Regulations 1998:
reg. 8 (information and instructions reg. 9 (training):
(iii) Health and Safety at work etc. Act 1974:
reg. 7 (duties on employees);
with particular emphasis on the employee involvement in the implementation of these specific conditions. 5. Other Related Assessment Sheets in this Section are: 11.G5 11.G7 11.G9 11.G10 11.G11 11.G12 6. Command, Control, Communications [C3] and Decision Making Permit to Work Systems Organisational Change Management Knowledge Management Contractualisation: Communications and Competence Multi Skilling/Multi Tasking
7.
8.
295
11.G9:
Introduction
Organisational Change Management
This topic warrants a sheet in its own right, as it is applicable to Regulation 14 and 15 revisions to safety cases specifically. Transitional arrangements are of specific interest, in addition to the endconditions resulting from the completed change, and we need to be satisfied that adequate [and timely] arrangements are put in place by the duty holder. 1. Confirmation should be obtained that a procedure is in place for the management of change in relation to an installation, and that this is in accordance with a recognised standard or code of practice. Recognised standards/codes of practice would include: RR 107 Development of internal company standards of good management practice and task-based risk-assessment tool for offshore work-related stress HSG 48 Reducing Error and Influencing Behaviour HSG 65 Successful Health and Safety Management OTO 2002/016 Framework for assessing HF capability 2. Where a standard/code of practice other than those listed above has been employed, judgement as to the adequacy of arrangements can only be assessed on an individual basis, and the duty holder should be required to demonstrate that no significant increase in risk will arise during the transitional period, or upon its completion. Relevant Legislation, ACOP and Guidance includes: Offshore Installations (Safety Case) Regulations 2005 and guidance (L30). Specifically: Regulation 12(1)(d) - see guidance para 177(a) re sufficient particulars which should be included within the case; and the associated schedules and APOSC principle 21 requirements for including the results of the PFEER regulation 5 assessment in the safety case needs consideration of the human element on any impact on the SCE. Offshore Installations (Prevention of Fire and Explosion, and Emergency Response) Regulations 1995 plus associated ACoP and guidance (L65) Assessment Principles for Offshore Safety Cases [APOSC] 4. Specific Technical Issues: This topic is treated separate to, [but in conjunction with], SMS. This is because it is applicable to 14(2) where organisational change may be deemed to be a material change to the original safety case. Of particular importance are the transitional arrangements, particularly in instances of downmanning, to ensure the continued integrity of maintenance and safe operation procedures. It is incumbent upon the duty holder to make a convincing demonstration that adequate transitional provision has been made for such, and that security provisions [eg to prevent sabotage] are in place to ensure safe operation of the installation. Inspection links: Compliance [Regulation 16]. 5. Other Related Assessment Sheets in this Section are: 11.G1 11.G2 Human Error: Selection, Competence and Training Human Error: Stress, Fatigue, Shifts and Organisational Factors
3.
296
11.G5 11.G11 6.
Command, Control, Communications [C3] and Decision Making Contractualisation: Communications and Competence
Cross-Referenced Sections and Sheets are: Section 2 Section 5.1 Sheet 5.1.F23 Vessel Impact Loss of Containment - Process Isolations
7.
8.
297
11.G10:
Introduction
Knowledge Management
Assessment should be made to ensure that, along with a robust structure of procedures, design, operational and historic data associated with hazard/risk assessment is retained, along with maintenance and equipment failure records. Such data can, in certain cases, drive change/improvement in the installations design, equipment and/or operation. Hitherto, this assessment sheet has not squarely resided within any of the topic sections, but since human factors deals with procedural and SMS integrity, it is perhaps most applicable for assessment by OSD3.6. 1. Confirmation should be obtained that a procedure is in place for the management and retention of design, operational, risk and historic knowledge and data in relation to an installation, and that this is in accordance with a recognised standard or code of practice. Recognised standards/codes of practice would include: RR173 The development of a knowledge-based system to develop information to designers RR128 The safety implications for offshore maintenance of using proprietary management/scheduling software RR011 Preliminary assessment of Linux for safety related systems RR012 Dealing with differences in expert opinion 2. Where a standard/code of practice other than those listed above has been employed, judgement as to the adequacy of arrangements can only be assessed on an individual basis, and the duty holder should be required to justify why its procedures/practices in the relevant areas will deliver an equivalent level of health and safety performance. Relevant Legislation, ACOP and Guidance includes: Offshore Installations (Safety Case) Regulations 2005 and guidance (L30). Specifically: Regulation 12(1)(d) - see guidance para 177(a) re sufficient particulars which should be included within the case. Also Schedule 7: verification particulars; and the associated schedules and APOSC principle 21 requirements for including the results of the PFEER regulation 5 assessment in the safety case: need consideration of the human element on any impact on the SCE. Offshore Installations (Prevention of Fire and Explosion, and Emergency Response) Regulations 1995 plus associated ACOP and guidance (L65) Assessment Principles for Offshore Safety Cases [APOSC] 4. Specific Technical Issues: There is a particular interface with the assessment of maintenance, as such plant and historic data informs maintenance scheduling arrangements. Inspection links: Compliance [Regulation 16]. 5. Other Related Assessment Sheets in this Section are: None 6. Cross-Referenced Sections and Sheets are:
3.
298
Section 2 Section 5.1 7.
Vessel Impact Loss of Containment - Process
8.
299
11.G11:
Introduction
Contractualisation: Communications and Competence
This topic is of sufficient prominence to warrant an assessment sheet in its own right. The management of contractors, and the issues of ownership, responsibility, independence and competence are issues of concern in a heavily contractualised industry, where responsibility is sub-contracted along with work-packages. Assessment of both procedures and cultural aspects of contractualisation needs to be carefully undertaken, in order to gain assurance that risk is controlled offshore. 1. Confirmation should be obtained that a procedure is in place for the management and supervision of contractors by the duty holder, and that this procedure conforms with a recognised standard or code of practice. Recognised standards/codes of practice would include: HSG 48 Reducing Errors and Influencing Behaviours HSG 65 Successful Health and Safety Management HSE/OIAC Guidance on Contractor Management STEP Guide to Interfacing SMS OTO 1999/065 Effective supervisory safety leadership behaviours in offshore oil and gas industry 2. Where a standard/code of practice other than those listed above has been employed, judgement as to the adequacy of the arrangements can only be assessed on an individual basis, and the duty holder should be required to justify why its procedures/practices in the relevant areas will deliver an equivalent level of health and safety performance. Relevant Legislation, ACOP and Guidance includes: Offshore Installations (Safety Case) Regulations 2005 and guidance (L30). Specifically: Regulation 12(1)(a) - SMS; the associated schedules and APOSC principle 21 requirements for including the results of the PFEER regulation 5 assessment in the safety case: need consideration of the human element on any impact on the SCE, particularly where examination/verification is performed by contractor Offshore Installations (Prevention of Fire and Explosion, and Emergency Response) Regulations 1995 plus associated ACOP and guidance (L65) Assessment Principles for Offshore Safety Cases [APOSC] 4. Specific Technical Issues: Where specific roles require an individual from the duty holder side to be independent, as in the case of SCE verification, then evidence has to be provided to support this, and how this independence can be afforded in the contractor situation. In addition, the duty holder must demonstrate that its management of, and communication with contractors is procedurally defined, along with training, responsibility and plant proprietary responsibility [eg crane operations]. Inspection links: Compliance [Regulation 16]. 5. Other Related Assessment Sheets in this Section are:
3.
300
11.G8 11.G9 11.G10 6.
Employee Involvement Organisational Change Management Knowledge Management
Cross-Referenced Sections and Sheets are: Section 5.1 Section 7 Sheet 7.F4-F9 Loss of Containment - Process Diving Risk Management Measures [Inherent Safety]
7.
8.
301
11.G12:
Introduction
Multi Skilling/Multi Tasking
This assessment sheet is closely linked to 11.G1 on competence/training etc, but is subtly different and does require to be a separate assessment sheet. It is similarly related to stressinduced human error, [11.G2], but also does not fit squarely within this sheet either. In brief, it is an increasing trend offshore, and has its own procedural requirements and failure modes. Assessment is therefore required of operational safety cases in this specific respect. The duty holder should give some description within its management arrangements as to how it will control this particular mode of work amongst the installation crew. 1. Confirmation should be obtained that the safety case makes a description of, and takes due account of both multi-skilling and multi-tasking, and any potential impact on human reliability. Any justification given should take due account of a recognised standard or code of practice. Recognised standards/codes of practice would include: OIAC Guide to multi skilling HSG 48 Reducing Error and Influencing Behaviour RR 086 Competence Assessment for the Hazardous Industries CRR 2001/348 Assessing the Safety of Staffing Arrangements for Process Operations in the Chemical and Allied Industries OTO 1999/025 Safety Implications of Self Managed Teams 2. Where a standard/code of practice is listed above, and an alternative has been employed, judgement as to the adequacy of the arrangements can only be assessed on an individual basis, and the duty holder should be required to justify why its approach will deliver an equivalent level of health and safety performance. Relevant Legislation, ACOP and Guidance includes: Offshore Installations (Safety Case) Regulations 2005 and guidance (L30). Specifically: Regulation 12(1)(a) - SMS Offshore Installations (Prevention of Fire and Explosion, and Emergency Response) Regulations 1995 plus associated ACoP and guidance (L65) Assessment Principles for Offshore Safety Cases [APOSC] 4. Specific Technical Issues: The duty holder needs to specify the limits it will apply to the extent of multi-skilling/tasking amongst its workforce to demonstrate that it will not be in a position where one individuals reliability will be compromised by overloading. It must be stressed that we are concerned with the safety effects of human failure, rather than any chronic health effects, which are the domain of the Occupational Health Specialist Section. In addition, where specific roles require an individual from the duty holder side to be independent, then evidence has to be provided to support this, particularly in a multitasking situation. Inspection links: Compliance [Regulation 16]; PFEER assessment of SCEs. 5. Other Related Assessment Sheets in this Section are:
3.
302
11.G1 11.G2 11.G9 11.G11 6.
Human Error: Selection, Competence and Training Human Error: Stress, Fatigue, Shifts and Organisational Factors Organisational Change Management Contractualisation: Communications and Competence
7.
8.
303
12. HUMAN VULNERABILITY

1. Scope This Section provides guidance for the assessment of safety case content with respect to the establishment of appropriate criteria for human vulnerability in the event of exposure to major accident hazards offshore. 2. Assessment of Adequacy of Demonstration The evaluation of individual risk of harm that may result from an individuals exposure to each major accident hazard is to be assessed by establishing the level of harm [dose] required to produce or prevent a specified effect [ie impairment of emergency functions, escape or death] from each major accident hazard scenario identified. This is expected to include direct effects, accumulation of hazards and escalation of a major accident. Human vulnerability criteria for the following should be addressed in the safety case:
Blast overpressure Thermal radiation Elevated temperature and thermal stress Hydrocarbon combustion products Oxygen depletion Non-hydrocarbon combustion or decomposition products Release of toxic gas Noise Impact Cold water immersion Combined effects
The assessor should examine the adequacy of the human vulnerability criteria. 3. Depth of Assessment Confirmation should be obtained that the human vulnerability criteria has been determined against accepted standards and applied in accordance with recognised Codes of Practice. Recognised standards, criteria and methods of application are detailed in SPC/Tech/OSD/tba Indicative Human Vulnerability to the Hazardous Agents Present Offshore for Application in Risk Assessment of Major Accidents. Where a vulnerability criterion and method of application other than those listed above have been employed, judgement as to the adequacy of the vulnerability modelling can only be assessed on an individual basis, and the duty holder should be required to justify why its procedures or practices in the relevant areas will deliver an equivalent level of health and safety performance. 4. Cross-Referenced Sections and Sheets are:
304
None 5. Lead Assessment Section for this Sheet: OSD3.2 6. Team responsible for authoring and updating this sheet: OSD3.2
305
13. QUANTITATIVE RISK ASSESSMENT [QRA]

1. There are no standards for carrying out QRA, but the following are recognised as useful sources of guidance. Publication 99/100 CMPT (Centre for Marine and Petroleum Technology) (1999) A Guide to Quantitative Risk Assessment for Offshore Installations, J Spouge (Ed) UKOOA Guidelines for Fire and Explosion Hazard Management Issue 1, 1995 API 14J (RP14J) (1993) Recommended Practice for Design and Hazards Analysis for Offshore Production Facilities 2. Where guidance other than those listed above has been employed, judgement as to the adequacy can only be assessed on an individual basis, and the duty holder should be required to justify why its procedures/practices in the relevant areas will deliver an equivalent level of health and safety performance. Relevant Legislation, ACOP and Guidance includes: Offshore Installations (Safety Case) Regulations 2005 Offshore Installations (Prevention of Fire and Explosion, and Emergency Response) Regulations 1995 Fire, Explosion and Risk Assessment Topic Guidance, HSE website 2004 Fire and Explosion Strategy, HSE website 2003 Use of Risk Assessment in the Offshore Industry (currently being developed for HSE) 4. Specific Technical Issues: None 5. Other Related Assessment Sheets in this Section are: None 6. Cross-Referenced Sections and Sheets are: None 7. Lead Assessment Section for this Sheet: OSD 3.2 8. Team responsible for authoring and updating this sheet: OSD 3.2
3.
306
14. GLOSSARY OF ABBREVIATIONS

ABS ACOP ALARP API APOSC ASME BV CAA CBA CCTV CFD CIA CMPT COGENT DCM DCR DnV DP DWR E & P Forum ECC EEMUA EER ERP ESD FMD FMEA FMECA American Bureau of Shipping Approved Code of Practice As Low As Reasonably Practicable American Petroleum Institute Assessment Principles for Offshore Safety Cases American Society of Marine Engineers Bureau Veritas Civil Aviation Authority Cost Benefit Analysis Closed circuit television Computational Fluid Dynamics Chemical Industries Association Centre for Marine and Petroleum Technology Sector Skills Council for the Oil and Gas Extraction, Chemical Manufacturing and Petroleum Industries Deputy Case Manager Offshore Installations and Wells (Design and Construction, etc) Regulations 1996 Det Norske Veritas Dynamic Positioning Diving at Work Regulations 1997 The Oil Industry International Association Exploration and Production Forum Emergency Control Centre Engineering Equipment and Materials Users Association Escape, Evacuation and Rescue Emergency Response Plan Emergency Shutdown Flooded Member Detection Failure Modes and Effects Analysis Failure Modes Effects and Consequence Analysis
307
FPP FPSO FSU HC Helo Ops HID HSE IGN IMCA IMO IP IR ISO IVB JIP LR MHSWR MOD MODU MOU MPI MSC NAI NMD NORSOK NUI OGP OHMEC ON OREDA OSD OTO
Floating Production Platform Floating Production, Storage and Offloading Vessel Floating Storage Unit Hydrocarbon Helicopter Operations Hazardous Installations Directorate Health and Safety Executive Interim Guidance Notes International Marine Contractors Association International Maritime Organisation Institute of Petroleum Individual Risk International Standards Organisation Independent Verifying Body Joint Industry Project Lloyds Register Management of Health and Safety at Work Regulations 1999 Ministry of Defence Mobile Offshore Drilling Unit Mobile Offshore Unit Magnetic Particle Testing Marine Safety Committee Normally Attended Installation Norwegian Maritime Directorate Norwegian Standards Organisation Normally Unmanned Installation International Association of Oil & Gas Producers Offshore Mechanical Handling Equipment Committee Operations Notice DNV Offshore Reliability Data Handbook Offshore Division Offshore Technology Report
308
PA PFEER PFP PLL POB PPE PSF PTW QRA RIDDOR RT SAR SBV SCE SCHAM SCI SCR SFAIRP SIM SMS SNAME TA TEMPSC TLP TR UKCS UKOOA UPS UT WOAD
Public Address Offshore Installations (Prevention of Fire and Explosion, and Emergency Response) Regulations 1995 Passive Fire Protection Potential Loss of Life Persons on Board Personal Protective Equipment Partial Safety Factor Permit to Work Quantified Risk Assessment Reporting of Injuries, Diseases and Dangerous Occurrences Regulations 1995 Radiographic Testing Search and Rescue Standby Vessel Safety Critical Element Safety Case Handling and Assessment Manual Steel Construction Institute Offshore Installations (Safety Case) Regulations 1992 So Far As Is Reasonably Practicable Structural Integrity Management (System) Safety Management System Society of Naval Architects and Marine Engineers Topic Assessor Totally Enclosed Motor Propelled Survival Craft Tension Leg Platform Temporary Refuge United Kingdom Continental Shelf United Kingdom Offshore Operators Association Uninterrupted Power Supply Ultrasonic Testing World Offshore Accident Database
309

Hse Offshore Guide

Diunggah oleh

Informasi Dokumen

Deskripsi Asli:

Hak Cipta

Format Tersedia

Bagikan dokumen Ini

Bagikan atau Tanam Dokumen

Opsi Berbagi

Apakah menurut Anda dokumen ini bermanfaat?

Apakah konten ini tidak pantas?

Hak Cipta:

Format Tersedia

Hse Offshore Guide

Diunggah oleh

Hak Cipta:

Format Tersedia

HEALTH AND SAFETY EXECUTIVE HAZARDOUS INSTALLATIONS DIRECTORATE OFFSHORE DIVISION

Assessment of Adequacy of Demonstration

Attendant vessels Passing vessels

Positioning Failure Navigational Failure Procedural Failure Human Error

The usual measures are employed in controlling the hazard:

Control through Quality Assurance Operating envelope

Risk Management Measures

Verification, Testing and Inspection SBVs, Communications and Procedures

Vessel Impact Source of Hazard Initiators Risk Evaluation

Risk Management Measures

Loss of Integrity of Structure, Process, Pipelines, Wells Fatalities of Workforce

Lead Assessment Section for this Sheet: OSD5.5

Team responsible for authoring and updating this sheet: OSD5.3

Attendant and Passing Vessels

Failures: Positional, Navigational, Procedural, Human Error

Procedural Failure Incorrect/Inappropriate Not correctly applied

Human Error Commission/Omission/Fatigue

Lead Assessment for this Sheet: OSD5.5

Team responsible for authoring this sheet: OSD5.3

Likelihood Factors [including historic data]

Specific Technical Issues: None

Other Related Assessment Sheets in this Section are: None

Cross-Referenced Sections and Sheets are: None

Lead Assessment Section for this Sheet: OSD5.5

Team responsible for authoring and updating this sheet: OSD5.3

Loss of Integrity to Installation Systems Fatalities to Workforce

Specific Technical Issues: Injuries to people o o Direct contact Strong vibration

Loss of stability o o o Direct contact Strong vibration Large relative deformation

Loss of position o Direct contact

Cross-Referenced Sections and Sheets are:

Sheet 4.1.G5 Sheet 10.F8 Section 11 Section 12 7.

Collision/Grounding Ship Collision Human Factors Human Vulnerability

Lead Assessment Section for this Sheet: OSD5.5

Team responsible for authoring and updating this sheet: OSD5.3

Subsea Facilities, Exclusion Zone

Specific technical issues: None

Other Related Assessment Sheets in this Section are: None

Lead Assessment Section for this Sheet: OSD5.5

Team responsible for authoring and updating this sheet: OSD5.3

2.F5 Verification, Testing & Inspection

Lead Assessment Section for this Sheet: OSD5.5

Team responsible for authoring and updating this sheet: OSD5.3

SBVs, Communications & Procedures

Specific Technical Issues: None

Lead Assessment Section for this Sheet: OSD5.5

Team responsible for authoring and updating this sheet: OSD5.3

SBVs, Visual & Radar, Platform Mounted Radar, Automated Systems

Specific Technical Issues: None

Lead Assessment Section for this Sheet: OSD5.5

Team responsible for authoring and updating this sheet: OSD5.3

Specific Technical Issues: None

Lead Assessment Section for this Sheet: OSD5.5

Team responsible for authoring and updating this sheet: OSD5.3

Lead Assessment Section for this Sheet: OSD5.1 to OSD5.3

Team responsible for authoring and updating this sheet: OSD5.3

2.F10 Robust Structure, Plant and Equipment

Specific Technical Issues: None

Team responsible for authoring and updating this sheet: OSD5.3

LOSS OF STRUCTURAL INTEGRITY

Accidental hazards Environmental hazards Management system hazards

Risk Management Measures

Hazard Studies [HAZOPS etc] Generic Historical Data

Use of Best Design Practice