1 Many serious accidents or incidents, including the Piper Alpha disaster in 1988, involve root

causes associated with shift handover. An outgoing operator is handing over to an incoming
operator at the end of a shift.
(a) Explain the key principles of safe shift handover.
Information on specific operational issues is not required in part a. (10)
The key principles of safe shift handover are:
Good shift handover allows the accurate and effective communication of vital information to
incoming personnel in order to allow the safe operation of process plant and equipment. There
are three elements which contribute to an effective shift handover:
A period of time when the outgoing team prepares the information it will be conveying to
the incoming team
A period of time when both the outgoing and the incoming team communicate with each
other and exchange all relevant information.
A period of time when the incoming team cross checks the information passed onto it as
it takes the responsibility for the ongoing operations.
Management should ensure that the facilities, the arrangements and infrastructure allow for
good shift handover practice. This should:
Provide all staff who are involved in the handover process with training and the
development of good communication skills.
Provide written procedures for effective shift handover
Emphasize the importance of effective shift handover
Ensure that both parties take joint responsibility for conducting an effective shift
handover.
Emphasize the use of both written and verbal means of communication
Ensure that any important information is written into a log or report form. The log or
report form should be brought to the attention of personnel at handover.
Include all personnel from both the incoming and outgoing team in the handover without
exception.
Ensure that managers and Supervisors are available at all times and ensure an open
door policy.

Should be treated as high priority.

(b) Outline the main operational issues communicated at shift handover. (10)
The main operational issues communicated at shift handover include:
Work permits-the status of existing permits and the status of work in progress.
The updating of work permits
Preparations for upcoming maintenance
New personnel to the shift
Any plant overrides-existing and planned
Information about any abnormal events
Any existing or planned shutdowns
Any change in plant parameters
Any routine operations and existing parameters which may need to be carried out by the
personnel from the incoming shift
Any breakdowns which may have occurred
Any faults which have occurred with safety critical equipment

Inhibits to the fire and Gas (F&G) and Emergency Shutdown systems
Any completed work and equipment which have returned to service

SECTION 2
You are advised to spend about one and a half hours on this section, which contains TEN
questions.
2 (a) Identify the hazardous properties of Liquid Petroleum Gas (LPG). (4)
hazardous properties of Liquid Petroleum Gas - LPG
Heavier than air
Vaporisation - Cold
Storage - Leaks
Fire / Explosion
(b) Outline the risks associated with Liquid Petroleum Gas (LPG). (4)
Risks associated with Liquid Petroleum gas LPG.
Asphyxiation
Burns (Hot and Cold)
Fire / Explosion
3 Safety cases and safety reports provide documented evidence that an oil and gas installation
is safe.
Outline the typical content of these types of documents. (8)

Identification of major accident hazards using risk assessments (Q

SQ QRA), bow-tie diagrams, etc. The impacts of potential major accident
hazards should be analysed and identify:
oEach hazard scenario.
oThreats to safety and what causes them.
oBarriers to prevent those threats, Consequences of each threat were it realised.
oRecovery measures required.
oFactors that could escalate the hazard or its consequences.
Evaluation of major accident risks and measures taken to
controlthose risks, using details of all existing "designed-in"
precautionaryand safety measures. Existing risk controls should be
evaluated tosee if these are adequate or further risk controls are required
todemonstrate ALARP. This would include:
oIdentify each hazard/incident scenario. Assess frequency criteria.
oAssess consequence criteria
oAssess occupied and unoccupied locations as separate criteria.
oAssess Evacuation, Escape and Rescue (EER) facilities and requirements.
oFor higher risks, assess individually.
oIdentify and assess the risk control measures proposed to achieve ALARP.

 Arrangements for audit and audit reports with a plan showing

thetype of audit (internal, external), how often they will be carried, inwhat
areas they will be conducted, how recommendations will bedealt with and
actioned, and who will be responsible for completion.
Having an adequate safety management system in place,
includingthe management of contractors and sub-contractors.
Major accident prevention policies -in the case of safety reports
these would need supporting information from the safety management system
Identification of the safety critical elements that are in place
tomanage major accident hazards (scenarios, possible causes,controls,
recovery systems).
Details of the emergency plan. This would include layout drawingsof
the installation, showing locations of all safety and emergencyequipment,
control points (e.g. control room, radio room, etc.),isolation and shut-off
controls, safe access routes and escapeladders, access to boats and
manning and launch procedures.
4 (a) Identify THREE marine hazards associated with all types of Floating Platform Storage
Offloading Units (FPSOs). (3)
Oil/gas leak arising from:- Blowouts/pipeline leaks/process leaks
Non-process incident:- such as fire/chemical spill and leaks
Marine event:- such as Collision of supply, stand-by and support vessels/collision
with other vessel/capsize or grounding
Extreme loadings due to wind or waves
Structural failure due to: Fatigue/Design error
Failure of derricks, cranes or other equipment
Dropped objects during:- Construction/crane operation/cargo transfer/drilling
operation
Helicopter crash or fire during refuelling
Capsize of crew boats or accident to personnel during transfer(crew
change, in-field transfer)
Construction
accident:
onshore
or
offshore
work/marine
installation/commissioning activities/pipe laying
Diving accident
Slips, trips
Extreme environmental conditions (weather, waves, sea currents/temperature, ice, etc).
Accelerated wear and corrosion -the stress of constant movement/buffeting and
aggressive salt spray mean that structures and equipment can quickly fail if maintenance
is neglected.

Collisions with other vessels and structures, these may result in environmental damage
(oil spills). An inadequate/defective mooring, combined with extreme weather may
contribute to this.
The intrinsic hazards of the substances for example, LNG, H2S
and drilling fluids ('mud') and the potential for fire.

(b) Identify suitable controls that minimise risk when operating Floating Platform Storage
Offloading Units (FPSOs). (5)
ship should be securely moored
The responsible people in charge of terminal and tanker, respectively, should agree a
loading/off-loading.
The ship's doors, ports, windows, etc. which open onto the tank deck, should be kept
closed (to avoid ingress of flammable vapours and the risk of explosion in
accommodation areas).
Ventilation systems may also have to be adjusted or disconnected so as not to suck in
flammable vapours or act as an ignition source.
Cargo tank vents should be protected by flame arresters.
Ship to terminal connections (such as via directly connecting hose or marine loading
arms/ metal cargo arms) can be fitted with an emergency release.
Liquid loading lines and vapour emission control lines (vapour recovery) should be
dearly distinguished, to avoid misconnection.
Hoses should be inspected for defects before use.
The position of the hoses/loading arms should be adjusted, so as not to place undue
strain on the components (the hoses themselves, ship's manifold connection, etc).
The weather should be monitored before and during the operation -the operation being
suspended in cases where high winds or electrical storms are expected.
Crews should keep watch for leaks during the operation, being prepared to halt if leaks
are detected.
Precautions against electrical discharge need to be observed for electrical discharge
between ship and terminal.
Co-ordinate activities (or take precautions), for example, if hazardous activities are being
undertaken in adjacent tanker berths.
Do not allow tugs, helicopters, etc. to approach too dose during the operation (or
suspend operations if they must).
There should be joint formal agreement between the master of the vessel and the
terminal authority on readiness to load/unload cargo.
No transfer should take place before this. Both sides should monitor the operation and
communicate throughout.

5 An oil installation contains a vessel that requires protection from fire exposure in the
form of active or passive fire protection.
(a) Identify TWO examples of passive fire protection to protect vessels. (2)

Fire Walls
Fire doors
Fire resistant coatings
Thermal insulation
(b) Outline why the metal legs of the vessel should be protected. (2)
Fires can cause thermal weakening of steelwork and result in the collapse of structures, failure
of equipment, and subsequent escalation of the initial event.
(c) Outline how a fixed water deluge system could provide fire protection. (2)
A fixed water deluge system could provide protection for a distillation column by extinguishing
the fire, controlling the fire or by providing protection for the adjacent distillation columns with
the cooling effect the fixed water deluge system provides
(d) Identify TWO additional examples of active fire protection. (2)
Foam Systems
Water Mist Systems
6 Outline the following failure modes that may lead to loss of hydrocarbon containment from
storage tanks/vessels or pipelines:
(a) creep; (2)
Is slow movement under stress, made more severe with heat for long periods, especially with
increases in temperature approaching melting points.
(b) stress corrosion cracking; (2)
Occurs under tensile stress and is worse in a corrosive environment at elevated temperatures.
(c) thermal shock; (2)
Cracking associated with rapid temperature change with different parts of an object expanding
by different amounts where the stress overcomes the strength of the materials.
(d) brittle fracture. (2)
Rapid run of cracks through a stressed material with plastic deformation before failure caused
by such things as repetition of inappropriate heating or pressurising rates
7 Outline FOUR types of work activity associated with an oil platform that might require a
permit-to-work AND give a reason in EACH case for the requirement. (8)
REPEATED
8 A large oil company is proposing to build a new oil and gas installation in the North Sea. The
Process Safety Management Team is analysing past incidents and database records from the
Oil and Gas Industry.
Excluding active and passive fire protection systems, outline physical design features of the
platform that would minimise risk to operating personnel in the event of a major incident. (8)
Physical design features of an offshore platform that would minimise risk to operating personnel
in the event of a major incident:
Plant separation
Compartmentalisation
Protection of personnel / equipment
Means of escape
Blow out panels
Temporary refuges with communications & control
9 (a) Identify TWO ways in which vapour clouds can be generated. (2)
Sudden depressurization
Rupture of vessel

Loss of containment
Uncontrolledbuildup of pressure
(b) Outline how a vapour cloud explosion can be generated. (4)
Vapour cloud explosion can be generated by;
Confined / unconfined generation
Vapour cloud explosions may arise from vaporization of a release of liquefied gas from a
ruptured vessel or pipeline
(c) Identify the physical consequences of vapour cloud explosions. (2)
Physical consequences of vapour cloud explosions;
Overpressure
Fire & explosion
Resulting debris as airborne missiles
10 An operator is draining a flammable liquid from process pipework to a metal container. The
supervisor is concerned about the possibility of an electrostatic charge forming and stops this
operation until a risk assessment is undertaken. During this work activity:
(a) identifyfactors that influence the generation of the electrostatic charge; (4)
Factors that influences the generation of the electrostatic charge:
Hot Dry Weather
Flow rate,
Overfilling
Lack of earthing / bonding
Liquid instability
Splash Filling
None Conductivity of materials
Agitation
Filters
Pressure Velocity
(b) outlinepractical ways of minimising the formation of an electrostatic charge. (4)
Practical ways of minimising the formation of an electrostatic charge:
Humidification of the atmosphere
Antistatic additives
Reduce flow velocity
Intrinsically safe equipment
Bonding & Grounding of equipment & containers
Avoid splash filling by submerging the fill pipe bellow the liquid level in the container
Increasing the conductance of floors, footwear
11 An employee was seriously injured in an accident at work within an oil and gas installation.
Identify the documented information that might be used by the investigating team to determine
the causes of this accident. (8)
Documented information that might be used by the investigating team to determine the causes
of an accident;
PTW
Photographs
CCTV Footage
Witness Statements
Previous Health and Safety Meeting Minutes
Risk Assessments / JSA's

Method Statements
Control Room Data
Internal incident report forms
Maintenance records
Disciplinary records
Safe systems of work
Audit / inspection reports
SOP's
D & A Test results

Identify the hazards associated with crude/unrefined oil during extraction, storage and
processing.

The potential exists for a fire due to a leak or release of crude from heaters in the crude
desalting unit. Low boiling point components of crude may also be released if a leak
occurs.
Inadequate desalting can cause fouling of heater tubes and heat exchangers throughout
the refinery. Fouling restricts product flow and heat transfer and leads to failures due to
increased pressures and temperatures.
Cooling-tower water can be contaminated by process materials and by-products
including sulfur dioxide, hydrogen sulfide, and carbon dioxide, with resultant exposures.
Hazards such as those related to liquids and vapors when opening or draining pumps,
valves, and/or lines, and during product sampling, inspection, and maintenance activities
The potential for fire exists should hydrocarbon storage tanks be overfilled or develop
leaks that allow vapors to escape and reach sources of ignition.
Hazards related to product sampling, manual gauging, inspection, and maintenance
activities including confined space entry where applicable.

Identify two types of risk assessment techniques.

Two types of risk assessment techniques are:

QUALITATIVE Risk assessment (Q)

The qualitative method of risk assessment can generally be considered to not
involve equations based on numbers to evaluate risk. Using a qualitative
approach, a cable trailing in a walkway used by infirm older patients may be
evaluated as being a "high" risk, because it is felt that somebody is bound to trip

over it and the consequences would be severe. This is a useful, straightforward

approach; though it is a relatively subjective method that can easily lead
management to take action to control the risk, which is the purpose of risk
assessments.
SEMI-QUANTITATIVE Risk Assessment (SQ)
As discussed earlier (The 5 steps) it is half way between the simplest approach,
which uses qualitative methods, and the quantitative approach, which uses
probability statistics. Different people may have a different perception of risk, as a
result of training, life experiences and background. Semi quantitative methods try
to establish parameters that ensure a more consistent approach to risk rating and
attempt to overcome individual differences. Risk can be rated according to the
probability (likelihood) and severity (consequence) of harm resulting from a
hazard by using a guided approach to assigning a value to probability (likelihood)
and severity (consequence). Words commonly associated with the scale of
probability (likelihood) and severity (consequence) are provided to guide the
decision process. These words have a numeric value attached to them. The risk
rating is a
combination of the probability (likelihood) and severity (consequence) value.
Risk rating = Likelihood (Probability) x Severity (Consequences)
Likelihood Is how likely a loss will occur as a result of contact with the hazard.
Severity is the degree or amount of the resultant loss from contact with the
hazard.
Risk rating is the level of risk after control measures have been taken into
account.
QUANTITATIVE (Quantified) Risk Assessment (QRA)
This method is mainly used for complex risk and are based on equations related
to probabilities. In its simplest form it may be used to establish probability of
failure of a component that has safety critical implications, such as a pressure
relief valve. Data is sourced from the manufacturer on how often a failure can be
expected. If they provide information that they had experience of 10 failures out of
10,000 valves in the last year this would provide a quantitative probability of
failure of 0.001 for the valve.

Two of the techniques that can be used as a quantitative method are Event Tree
Analysis (ETA) and Fault Tree Analysis (FTA). Estimated failure rates are used in
a sequence of events to evaluate the probability of a resultant failure.
Hazard and Operability Studies (HAZOP) can be used to identify the undesired
events and the probability of failure rates may be worked out from the reliability
rates of the components given by the manufacturer. They may also come from
maintenance records of failure, be based on historical data or informed opinion.
Qualitative (Q) -using qualitative methods to determine frequency and
severity.
Semi-Quantitative (SQ) -where frequency and severity are
approximately quantified within ranges.
Quantified Risk Assessment (QRA) -where full quantification is
demonstrated.
As the assessment process moves through the stages, the level of detail will
increase proportionate to the risk, taking into account the level of estimated risk
within of tolerability; and the complexity of deciding on what (more) needs to be
done to reduce the risk.
Determining the Right Method of Risk Assessment: Risk
assessment is used to enable us to decide upon appropriate risk controls so assessors
should be suitably senior; qualified and competent. Start with a qualitative model and
enlarge the model (moving to SQ and QRA) as needed.

Outline the typical 3x3 matrix that can be used to assess the level of risk.

Outline the type of action that should be taken in relation to corresponding risk level.

Outline the concept of ALARP

In all cases, there is a danger that the risk reduction methods may be decided upon for the
wrong reasons -based on affordability rather than compliance with the law; and always the

danger to stop when the legal requirement has been seen to be met. This is where "as low as
reasonably practicable" comes in.
ALARP covers risk at levels of some uncertainty:
Unacceptable risk -risk cannot be justified at this level except in extraordinary
circumstances (intolerable)
ALARP (tolerability region) -at the higher risk end, risk may be undertaken only if a benefit
is desired, and where risk reduction is impracticable, i.e., grossly disproportionate to the benefits
gained. At the lower risk end, risk is tolerable if the cost to reduce it would outweigh the benefits,
Acceptable risk -where it is necessary to demonstrate risk remains this low, there is no
need for detailed working to demonstrate ALARP. At the lower end, this is negligible risk
(tolerable).
All risks should be reduced to ALARP, and in some cases cost-benefit analysis may be needed
to determine the appropriate level of controls.
All levels of risk should be compared with oil and gas industry guidance and best practice.

Identify four properties of hydrogen.

Widely used in petroleum refining as a catalyst regenerator

It is colourless and odourless and very light gas
Despite its stability, hydrogen forms many bonds and is present in many different
compounds.
Three naturally occurring isotopes of hydrogen exist: protium, deuterium, and tritium,
each with different properties due to the difference in the number of neutrons in the
nucleus.

Identify four hazards of hydrogen.

It is a highly flammable and explosive gas which forms ignitable mixtures in air over a
very wide range of concentrations (between 4.9 %- 75%)
It is not a toxic gas, but can asphyxiate at high concentrations.
Hydrogen fire should not be extinguished till the source is shut off as it can reignite and
explode.
It burns with an invisible flame.
An oil and gas industry employer is reviewing tendering contracts for an offshore platform
modification.
Identify the factors that should be considered when assessing the health and safety competence
of a contractor.

Factors that should be considered when assessing the health and safety competence of a
contractor:
HSE Policy's
Certifications - Accreditations
Commitment to HSE from senior management and how this is demonstrated - Safety
Management system and implementation - Safety tools used
Project records - track record of similar projects
Safety Statistics - KPI's records and achieved
Risk Management system and procedure
Previous incident investigations reports
Competency of employees and project staff
Safety Initiatives used with in the business and project
A pump containing flammable corrosive slurry has been stopped for maintenance.
An operator will prepare the pump for maintenance using a nitrogen supply, drain header and
collection vessel. Using this information;
Outline EIGHT risks to the operator when preparing the pump for maintenance.

Asphyxiation due to displacement of O

Fire
Explosion
Irritant/Corrosive substance
Incorrect isolation of valves
Incorrect Lock Out/Tag Out system
Lack of gas monitoring
Burst pressure lines causing injury

Identify the key stages of a workplace risk assessment

Identify the hazards
Decide who might be harmed and how
Evaluate the risks and decide on precaution
Record your findings and implement them
Review your assessment and update if necessary
Outline the meaning of `as low as reasonably practicable' ALARP
"ALARP" is short for "as low as reasonably practicable".
ALARP involves weighing risk against the trouble, time and money needed to control it. Thus,
ALARP describes the level to which we expect to see workplace risks controlled.
ALARP allows us to set goals for duty-holders
It is a key part of the general duties of the Health and Safety at Work Act 1974
ALARP is about weighing the risk against the sacrifice needed to further reduce it
To spend 1m to prevent five staff suffering bruised knees is obviously grossly disproportionate

But
To spend 1m to prevent a major explosion capable of killing 150 people is obviously
proportionate

Outline the term Flash Point

Flashpoint is the lowest temperature at which sufficient vapour is given off to "Flash" - that is,
ignite momentarily, and not carry on burning, when a source of ignition is applied to the vapour.
At the flash point the application of a naked flame gives a momentary flash rather than
sustained combustion, for which the temperature is too low

Identify the information that might be included on a checklist for an investigation

following an accident
1. Obtain basic facts:
Names of injured
Witnesses
Place
Date and time
Persons in area
Ascertain substances / chemicals involved
Injuries
Damage to equipment
2. Establish circumstances:
What happened?
Causes
Events leading to incident
Competence
Supervision
Behavior
3. Preventive Measures - Review the risk assessment for the activity:
What precautions should have been in force?
What training should those carrying out the activity have received?
What precautions were actually taken? Compare them with those which should have been
taken.

What training was actually given? Compare it with training which should have been given.
4. Was the initial response adequate?:
Firefighting
First aid
Containment and spillage
5. Identify underlying causes:
Management or supervision failure?
Lack of competence?
Inadequate training?
Shortcomings in original design of
Equipment
Facilities
Absence of a system for maintenance.
6. Determine action needed to prevent a recurrence
Improve physical safeguards
Introduce better test and maintenance arrangements
Improve work methods,
Provide and use personal protective equipment
Make changes to supervision and training arrangements,
Review procedures involving outside contractors
Improve inspection systems
Following preparation of a vessel for maintenance within an oil and gas installation a
low
specific
activity
LSA
radioactive
sludge
was
encountered
Identify hazards associated with the sludge.
Hazards associated with LSA, radioactive sludge;
Risk of fire, explosion.
Toxicity to Divers
Outline FOUR control measures to reduce the risk to workers exposed to the sludge.
FOUR control measures to reduce the risk to workers exposed to LSA sludge;
Wearing of correct PPE - Respirator
Monitoring devices and personal sensors
Explosion proof certified equipment

Safety procedures
Training
Identify TWO other pieces of workplace equipment where the sludge may be found
TWO other pieces of workplace equipment where the sludge may be found;
Shale Shakers
Mud Pits
An oil and gas industry employer is reviewing tendering contracts for an offshore
platform modification.
Identify the factorsthat should be considered when assessing the health and safety
competence of a contractor.
Factors that should be considered when assessing the health and safety competence of a
contractor:
HSE Policy's
Certifications - Accreditations
Commitment to HSE from senior management and how this is demonstrated - Safety
Management system and implementation - Safety tools used
Project records - track record of similar projects
Safety Statistics - KPI's records and achieved
Risk Management system and procedure
Previous incident investigations reports
Competency of employees and project staff
Safety Initiatives used with in the business and project
Oil and gas installations use water for cooling and heating although it can be a
hazard in some situations.
Identify risks with water AND give a practical example in EACH case
When stored under pressure as in Fire lines and steam water lines
May contain bacteria if not circulated e.g. dead end pipe legs
May cause an unstable reaction when mixed with some hydrocarbons
Outline operational control measures that could minimize the risk of plant damage
or injury during start-up or shutdown of a process
Shutdown:

Ensure work carried out under the controls of a PTW

All services are;
Stopped

Isolated
Drained down
Blanked
Empty & drain hydrocarbon facilities, with all liquids, gases and residues removed leaving the
plant safe to work on
Eliminate or control ignition sources
Suitable supervision of the operation
Certification of items that have been maintained or replaced
Start-up:

Establish all isolations reconnected, all blanks removed

Ensure all safety systems are operational
Ensure all systems are tested before start-up
Complete PTW
Emergency plan - in place
During an inspection an external fuel storage tank is found without a bund.
Outline the features which should be included in the design of a tank bund
Features which should be included in the design of a tank bund:
Ensure the maximum quantity of product can be contained within the bund at least 110%
Make allowance for the space occupied by other tanks
Located away from traffic routes
Impermeable base
No drain valve- rain water should be pumped out
Lightening protection

(a) Petroleum storage tank fires have been reduced substantially by using
floating roofs, but
a fire risk may still exist.
(i) Outline how a fire risk may still exist with floating roof tanks. (4)
The following fire risk may exist with floating tanks:
Lightning strikes
Leaks due to corrosion, damaged pipe work
Product overfill or high internal pressures
Rainwater or snow load sinks the roof and exposes fuel vapours

(ii) Identify TWO examples of fire protection systems used on floating roof
tanks. (2)

TWO examples of fire protection systems used on floating roof tanks:

Fixed foam systems
Portable foam fire fighting systems
Hose lines

Q10: Outline physical design features of an oil and gas installation that
would minimize
risk to operating personnel in the event of major incident. (8)

Q11: A road tanker is being drive from an onshore refinery to a petroleum

(gasoline)
station. Outline control measures of the Traffic Management process. (8)

Q6: Welding is to be carried out on a broken pipe support bracket within a

hydrocarbon
processing plant. The plant does not need to be shut down to carry out the
repair.
Outline factors that would need to be considered before welding takes
place. (8)

(a) Identify THREE properties of Hydrogen Sulphide H2S. (3)

(b) On an oil processing plant outline how activation of an H2S detection system, linked to a
controlroom, could prevent a fire. (5)

A worker has requested a permit-to-work in order to replace damaged thermal insulation in an

Overhead pipe rack that runs between two plants.
(a) Identify THREE hazards associated with this activity. (3)
(b) Outline control measures that should be implemented to reduce the risks to the worker. (5)

1 Draining water from a Liquid Petroleum Gas (LPG) vessel needs to be

controlled in order to prevent a Boiling Liquid Expanding Vapour Explosion
(BLEVE).
a) Identify FOUR hazardous properties of LPG. (4)
b) Outline how a BLEVE can be generated in an LPG vessel. (8)
c) Other than a BLEVE, outline the risks when draining water from an LPG
vessel. (4)
d) Outline control measure that minimize risk when draining water from LPG
vessels. (4)

a) Identify the significance of the "fire triangle". (3)

b) Identify FIVE types of ignition source that may cause a fire to occur,
AND give a
typical workplace example of EACH type. (5)
(a) Outline TWO ways in which vapour clouds can be generated. (2)
(b) Outline how a vapour cloud explosion can be generated. (4)
(c) Identify the physical consequences of vapour cloud explosion. (2)
Outline the factors that should be considered when providing a means of
escape inan oil and gas installation to enable all workers to reach a place of
safety in the event of a fire.

An electrically powered hydrocarbon pump, operating at 900 C, has

developed a
leak.
Outline the control measures that should be taken for the repair of the
pump. (8)

1 A crude oil storage tank needs to be taken out of service for an internal inspection. Although tank
inspection is hazardous establishing suitable control measures should prevent injury.
With reference to the description above:

(a) outline risks associated with internal inspection; (4)

(b) identify THREE items of equipment, associated with the normal tank operation, that would
need
electrical isolation prior to the inspection; (3)

(c) identify THREE ignition sources, associated with the preparation of the tank, that would need
to be considered; (3)

(d) outlinecontrol measures, other than control of ignition sources, that should be in place before
allowinginternal inspection of the tank; (8)

(e) identify TWO physical hazards the inspector would be looking for within the tank. (2)

(a) Give the meaning of safe operating envelope. (2)

(b) Identify FOUR operating parameters that are part of a safe operating envelope within an oil
and gas plant. (4)
(c) Outline the failure mode thermal shock. (2)

A large induced draught fan is used to exhaust gases from a furnace. The hot gas flow is controlled
through pneumatically operated vanes within the fan. The fan can be isolated from the process by
hydraulically operating inlet and outlet valves. The fan needs to be stopped and isolated for electric
motor and fan repairs.
In relation to Lock Out Tag Out (LOTO) in this example:

(a) identify FOUR residual energy sources that may need de-energising; (4)

(b) outline locations where locks and associated tags may need to be applied. (4)

Following preparation of a vessel for maintenance within an oil and gas installation a low specific
activity (LSA) radioactive sludge was encountered.
(a) Identify hazards associated with the sludge. (2)
(b) Outline FOUR control measures to reduce the risk to workers exposed to the sludge. (4)
(c) Identify TWO other pieces of workplace equipment where the sludge may be found. (2)
6 A hydrocarbon gas plant and nearby plant suffered catastrophic damage when a gas cloud
exploded after coming into contact with an ignition source. The damage may have been minimised if
an associated deluge system had activated and an emergency shutdown of the plant had been
performed. The disaster occurred when a pressure safety valve was removed for maintenance and a
blank was attached to the open pipework within a permit-to-work system. The blank was not
tightened sufficiently and when the pipework was re-commissioned a flammable gas cloud leaked
from the loose blank. Similar disasters may be prevented within the oil and gas industry through risk
control in the form of barrier models.
Hazard Consequence Hazard Control Barriers (Proactive Controls)Recovery Measures

(Reactive
Controls) TOP EVENT Barrier Model
(a) Using the description and the diagram above (the top event being the gas explosion), identify:
(i) ONE hazard; (1)
(ii) TWO hazard control barriers; (2)
(iii) TWO recovery measures; (2)
(iv) ONE consequence. (1)
(b) Outline reasons for involving all workers in the development of barrier models. (2)
7 (a) Smoke is one product of combustion that activates an automatic fire detection system.
Identify FOUR other products of combustion that may activate an automatic fire detection
system. (4)

(b) Identify the two basic types of smoke detectors. (2)

(c) Outline the reasons for installing a heat detector instead of a smoke detector in a kitchen. (2)

9 Identify hazards that should be considered when planning diver operations beneath an oil and
gas platform.

Factors that should be considered when planning diver

operations
1) The risks to divers:
Drowning; divers and others involved could drown.
Becoming trapped; e.g. by their own airlines or by moorings or stuck in a soft
seabed.
Problems with their breathing apparatus; such as faulty valves, incorrect gas
mixture, loss of gas.
Divers could develop illness during the dive; such as blackouts, decompression
sickness, nitrogen narcosis (a state similar to alcohol intoxication) or oxygen
poisoning.
There could be communications errors leading to mistakes being made.
Collisions could occur; e.g. vessel escaping from its mooring or from a remote
operated vehicles, ROV in use.
The effects of extreme environment; e.g. rough sea, changeable weather, cold,
poor visibility.
Seismic operations or simultaneous operations in the area of the dive.

11 During the construction of a new oil and gas installation many welds are used to join pipework to
vessels and pipework to pipework.

(a) Outline FOUR reasons why a weld may be defective. (4)

Most weld failures can be attributed to:

_ Improper design of weld joint
_ Poor selection of base materials and filler materials
_ Inappropriate welding processes
_ Residual stresses
_ Ineffective or non-existent inspection procedures
_ Welded components operating outside their safe parameters
(b)Identify FOUR techniques used for inspecting welds. (4)

Non- Destructive Testing (NDT)

Visual inspection
Visual inspection involves direct or indirect inspecting for surface condition,
defects, roughness and/or dimensional changes. Despite many other more
sophisticated NDT techniques, visual inspection plays an important role in the
detection of surface flaws and damage. This can be done unaided or with the use
of a microscope.
Some signs of damage may be obvious (for example, pitting and large surface
cracks), but some are not.
Dye Penetrant
This technique uses a three-part dye penetrant (usually in aerosol spray cans) to
dean the area and highlight a defect so that visual inspection can take place. It
can be used on a wide range of non-porous materials, but only relates to surface
defects.
Step 1: The surface of the material to be tested is cleaned thoroughly,
including the removal of any lubricants (oils or grease). This is carried out using a
solvent cleaner (part of the three-part kit).
Step 2: A penetrant dye (often a deep red colour) is then sprayed over the
cleaned area, penetrating into any surface cracks or abnormalities. After a period
of time (5 minutes-one hour) the excess dye is wiped away.
Step 3: To make the dye visible, it is sprayed with a "developer" which is
naturally white but absorbs the dye from the defective weld or surface, thus giving
a deep red indication on the weld as to the location of any defects. Visual
examination of these areas can then take place. Remember this is a chemical
process, so a hazardous substance risk assessment will be required.

Magnetic Particle
This technique works by magnetising the component and applying magnetic
particles or ink. Any defect in the component will show as it distorts the magnetic
field and the particles lie "differently". The defect tends to cause a concentration
of the magnetic field which attracts more particles to it than the surrounding
material.
The test works only on ferro-magnetic materials such as steel. The surface does
have to be clean. It detects surface cracks and subsurface cracks dose to the
surface.
Eddy Current
When a high frequency AC current is passed through a coil it sets up an
alternating magnetic field. If the coil is placed on the surface of a Ferromagnetic
material it sets up a current in the material (known as eddy current). Any
discontinuity in the surface causes a variation in the eddy current. It another coil
is placed adjacent to the first, it can detect the changes in eddy current and
indicate the location of a defect. These changes can be calibrated and used to
determine the depth of any defect.
The method requires trained operatives to carefully interpret the results, and it
can only work in the bulk of the material and not near any discontinuity, such as
holes, openings or edges. It is also unsuitable for thin material as this prevents
the formation of effective eddy currents.
2) NDT TECHNIQUES SUITABLE FOR SUB-SURFACE DEFECTS
Ultrasonic
Ultrasonic testing requires a generator to transmit ultrasound waves into a
material so that they can be detected when they reflect from within the material.
One advantage is that the generator is usually hand-held/portable, operating from
its own battery supply. The ultrasound waves are generated in a probe or
transducer that is moved across the surface.
The ultrasound' travels into the material and is "bounced" back to a receiver
mounted in the probe. The output is read on an oscilloscope, the results being
interpreted by a skilled operative. Any defect will cause a variation in the return
signal and this can be interpreted to indicate the depth of the defect.

Its portability and flexibility make ultrasonic testing an important non-destructive

testing technique. It may be in metals and on most non-metallic materials. Its
ability to penetrate the material allows it to measure depth and so it is used with
particular effect looking for corrosion in boilers, pipelines, etc.
Radiography
Radiography requires a source of gamma or X-rays which are allowed to pass
through the material and onto a strip of film. The radiation triggers a reaction in
the film's emulsion which shows where any discontinuity/defect exists.
It is used extensively in steel fabrication, such as welds on oil rigs, pipework and
reactor vessels.
Radiography requires a source of radiation, so there must be control of people's
exposure to it. Distance and use of barriers are normally used to control the risk
of exposure when testing is under way.
An operator is required to drain water from an LPG sphere.
(a) Identify the main hazard associated with this operation.
Hydrate formation can occur when draining water from pressurized
Liquefied Petroleum Gas (LPG) spheres. This can lead to valves freezing,
and if they are in an open position, LPG will be allowed to escape, which
may lead to an explosion.

(b) (b) Identify the control measures that can be applied in order to reduce
this hazard.
The operation of draining water from LPG spheres should only be carried
out by trained and authorized personnel using a sequential valve
procedure.

There are around twelve stages in the process of commissioning a process

plant or system. Identify SIX of those stages.
1 The system configuration is checked (walking the line).
2 The pipework and system integrity is checked.
3 The instrumentation system is checked.

4 All alarms are verified as working.

5 All lines and vessels are flushed and cleaned.
6 All ancillary equipment is inspected and assessed as to its adequacy.
7 All instruments and vessels are calibrated.
8 The start- up protocol is established.
9 The shutdown protocol is established.
10 Commissioning trials are undertaken.
11 The plant is hooked up.
12 The plant is handed over.

Many fixed and floating roof storage tanks have annular rims.
(a) Outline what an annular rim is.
The bottom plate in a storage tank is known as an annular plate. The
annular plate usually sits on a foundation of hardcore or a concrete ring
wall, and is joined to the walls of the tank. This junction between this
bottom plate and the wall of the storage tank is known as the annular rim.
(b) Explain what problems can be associated with annular rims
The joint where the annular plate and the tank walls meet (the annular rim)
is subject to constant stress. This is because the weight of the product
within the tank wants to push the walls outwards whilst at the same time
push the annular plate downwards. This creates a high level of bending
stress. The quality of the foundations will also have a bearing on the
downward deflection of the annular plate.
A further complicating factor to this stress is the fact that annular plates are
prone to corrosion attacks both on the outer side where the tank shell sits
on the annular rim, and on the underside of the annular plate where
trapped water may lie undetected. This corrosion, coupled with the
prolonged stress, can lead to stress corrosion cracking and failure
occurring without warning.
(c) Describe what an emergency shutdown system is and its function.
Because the petrochemical industry processes large quantities of
hazardous material within a contained environment, it needs to have in

place systems which will either prevent loss of containment from

happening or mitigate the consequences of such an event if it does
happen. These systems are known as Emergency Shutdown (ESD)
systems and take the form of various components, each of which is
designed to deal with a particular scenario and bring it under control in a
safe and effective manner.

Identify THREE typical actions an emergency shutdown system might perform if

activated.
_ Shutdown of part systems and equipment
_ Isolate hydrocarbon inventories
_ Isolate electrical equipment
_ Stop hydrocarbon flow
_ Depressurize/blow down
_ Activate fire-fighting controls (water deluge, inert gas, foam system, water mist)
_ Activate emergency ventilation control
_ Close watertight doors and fire doors
Explain why and when an emergency shutdown system might be bypassed.
All emergency shutdown systems and fire and gas systems need to be tested,
inspected and/or maintained on a regular basis to ensure they are functioning as
required. These testing and/or maintenance procedures involve the temporary
bypassing of safety system interlocks which would otherwise activate the
emergency shutdown system when testing, inspection or maintenance activities
were undertaken.
Describe the purpose and function of an interceptor.
Interceptors are a means of collecting contaminated water before it is discharged
to a foul drain or surface drain. Typically, interceptors have three separate
chambers, with the divisions between chambers extending down to the bottom,
and low level pipes connecting the chambers. This is so that when the

contaminated water enters the first chamber it can separate (oil will naturally float
on top of water) and be extracted. The water is then directed to the second and
third chambers via the low level pipe where any residual oil is also allowed to
separate and be extracted. Finally, the water from chamber three is channelled
into either a foul or surface drain, whichever is appropriate.
With regard to fixed and floating roof storage tanks, explain what erosion is and
where it might be expected to occur.
Erosion is the process of material being worn away by the constant movement of
product flowing over the surface. Areas such as filling and discharge points,
which experience large amounts of product flow, are the most vulnerable points.
Explain what hazards are associated with fixed roof storage tanks.
Normally, tanks have a pressure- vacuum relief valve fitted on or near the top of
the tank. This allows vapour or gas to escape or, in the case of a reduction in
pressure within the tank, allows air to enter the tank. Consequently, the pressurevacuum relief valve is a critical piece of equipment and the integrity of the tank
is dependent upon it working properly. The weight of any liquid pumped into a
tank will naturally apply outward pressure on the walls of the tank it is being
stored in. Also, as the liquid builds up inside the tank, the atmosphere in the void
needs to be vented out. If this does not happen the pressure will become
unsustainable and the tank may rupture. The contra view is also true in that when
a tank is emptied the liquid reduces and the void above the liquid needs to have
air vented in so that a vacuum is not created. If the air inlet valve is faulty, and a
vacuum is created, this may well cause the tank to collapse. There are other
factors which can cause increased or decreased pressure within the tank. These
include:
_ Storing a volatile product will cause gases to evolve and increase pressure.
_ Warm weather or direct sun on the tank will warm the product up and make it
expand, thus increasing pressure.
_ Cold weather will cool the product down and cause it to contract, thus
decreasing pressure.
With regard to floating roof storage tanks,

(a) Explain what landing the roof is and what hazards are associated with it.
Landing the roof is where the liquid in the tank falls far enough for the legs on the
underside of the floating roof to land on the base of the tank. The void between
the liquid and the roof will grow, which will allow a build- up of vapour to occur.
This has the potential to cause a fire and/or an explosion. Another issue with
landing the roof is that it causes a particular corrosion mechanism called frettingrelated corrosion. This is where repeated contact on the base of the tank by the
legs on the underside of the floating roof removes protective layers of rust scale
that may have formed, resulting in increased corrosion rates.
(c) Explain what control measures need to be taken if the roof is landed and why.
If the roof is landed, it is important that enough time elapses to allow the
space below the roof to become saturated with vapour so that it exceeds its
upper flammable limit. This is because when product is pumped into the tank
and the roof begins to lift, there is a chance that a spark may be generated
between the tank wall and the roof seal. Having the vapour in the ullage
saturated to beyond its upper flammable limit will ensure the vapour will not be
ignited by any errant spark. The amount of time required to allow the vapour to
become saturated may be as much as 24 hours.
Explain what a bund is and its purpose and function.
Where storage tanks hold a liquid product there is always the possibility that the
tank will rupture and spill its contents. Consequently, contingencies should be in
place to control such a situation. This is where a containment wall, known as a
bund, is built around a tank, or group of tanks to contain any spillage that may
occur until such time that it can be dealt with. The bund also stops the product
spreading too far, seeping into the ground, or seeping into the drainage or water
Systems. It also reduces (although it does not eliminate) the risk of fire and/or
explosion.
Define what a BLEVE is and describe an example of how a BLEVE might
develop.
A BLEVE is a Boiling Liquid Expanding Vapour Explosion. An example of how a
BLEVE might develop is when a vessel is partly filled with pressurized
hydrocarbon liquid (e.g. Liquefied Petroleum Gas). It will have a certain amount

space above it filled with vapour, and if the vessel is subjected to a fire the
pressure in the tank will increase due to the liquid going above its boiling point
and turning into a vapour. The pressure relief valve on the tank will allow the
overpressure to be vented to atmosphere in the first instance, but this will reduce
the amount of liquid in the tank still further, and the potential for the flame to
engage with a section of the tank containing vapour and not liquid will increase. If
this happens, the tank wall will weaken at this point
as the heat transfer to vapour is much less efficient than it is to a liquid. The
result is likely to be a sudden and catastrophic failure of the vessel, with a
discharge of vapour followed by an explosion when the vapour reaches the
flames. This is a Boiling Liquid Expanding Vapour Explosion (BLEVE).
With regard to hazardous areas,
(a) Explain why hazardous areas are categorized into different zones.
Gases and vapours can create explosive atmospheres. Consequently, areas
where these potentially hazardous airborne substances present themselves are
classed as hazardous areas so that appropriate controls can be implemented.
However, the frequency with which these substances present themselves is also
a factor in determining the appropriate level of control. For example, if the
presence of a flammable vapour only happens once every three months, it would
not be sensible to apply the same level of control as to an area where a
flammable vapour is present all day, every day. The answer is to apply a
classification to areas called zoning which places appropriate controls on the
type of equipment that can be used in that area and which potentially can create
a source of ignition, particularly electrical equipment, which reflects the risk
involved.
(c) Explain why equipment should be categorized for use in different zones.
The issue with electrical equipment is that it normally creates sparks, either as
part of the brushes coming in contact within the rotating armature, or when a
switch is activated. Either event can ignite any flammable gas present in the
atmosphere in the vicinity of the equipment. Consequently, manufacturers have
designed specialized equipment which overcomes, in various ways, the issue of
having sparks which are exposed to the local atmosphere. The particular solution

which is incorporated into each piece of equipment is signified by a code which is

marked on the equipments product identification label.
There are two main types of boiler used to heat water. Explain what they are and
how both types work.
A fire tube boiler is one which generates hot gases which then pass through a
number of tubes before being expelled out of the flue. These tubes run through a
sealed and insulated container of water and the heat from the gases is
transferred by thermal conductivity to the water, which then turns to steam. The
steam from the boiler then exits through a tube at the top of the container. Water
tube boilers have basically the opposite configuration of fire tubes. In a water
tube boiler, a number of tubes run through the furnace part of the boiler. This
heats the water inside the tubes, which turns it to steam.
In relation to boilers and furnaces, explain what flame impingement is and the
potential consequences if it is not rectified.
Flame impingement is where the flame produced by the burner, within the boiler
or furnace, comes into contact with the surface being heated. This is something
which the design of the boiler or furnace does not normally allow. This is because
the temperature of the surface being heated should always remain within
prescribed parameters and direct flame contact can lead to these parameters
being exceeded. If this occurs there tends to be a gradual build- up of carbon on
the inside of the tube at the point where the flame is in contact. This layer of
carbon acts as an insulator between the water product inside the tube and the
surface where the flame is impinging on it, compounding the effect the flame is
having on the heated surface of the tube. If this process is allowed to continue, it
can lead to the tube eventually becoming blocked, resulting in the potential
rupture of the tube.
Explain what total dissolved solids are and how they can be controlled.
Total dissolved solids are substances, such as minerals, salts and metals, which
are held in a suspended form within water. If these solids are of a sufficient
concentration within the water used in a boiler system, they can attach
themselves to the inside of boilers and, over time, build up to form scale. The first
action in controlling the effects of total dissolved solids is to maintain the solids
below a certain limit with the water. This is done by testing the water with a TDS

meter or conductivity meter. This measures the conductivity of the water which is
an indication of the measure of total dissolved solids within the water. The greater
the concentration of total dissolved solids in the water, the greater the likelihood is
that the dissolved solids will precipitate out of the water and form scale on the
inside of the boiler. If concentration levels are deemed to be too high, it is
necessary to drain some of the water from the system, called boiler blow down, in
order to remove some of those dissolved solids and keep the total dissolved
solids concentration below the level where they will precipitate.