Ep 95 0300 - (Hemp)

Shell International Exploration & Production B.V.
Overview Hazards and Effects Management Process
EP 95-0300
HSE MANUAL
Revision 0: 16 October 1995
EP HSE Manual Amendment Record Sheet

Section Number: Section Title:
Rev No. 0 All Original hard copy and CD-ROM issue * Chapter Nos.
EP 95-0300 Overview Hazards and Effects Management Process

Description to amendment Date dd/mm/yy 16/10/95 EPO/61 Amended by
* In this publication, some of the figures have been colour enhanced. This was done after the issue of the CD ROM. The next issue of the CD ROM will include these enhancements. There is no difference in content.
Contents
Contents
1
1.1 1.2
Introduction
4
4.1 4.2
Elements of the HSE Management System 1 Tools for the Hazards and Effects Management Process
1.2.1 1.2.2 Selection of tools Application and competence
Structured Review Techniques

Identify Hazards and Potential Effects Evaluate Risks
4.2.1 4.2.2 Scenario development (causes) Probability Consequence analysis Determination of risk Quantitative Risk Assessment (QRA) Screening criteria: limits/standards
17
17 19
20 20 20 22 22 26
2
2 2
2
2.1 2.2 2.3 2.4 2.5 2.6
Hazards and Effects Terminology

Hazards, Effects and Incidents Threats and Barriers
3
3 4
4.2.3 4.2.4 4.2.5 4.2.6
Consequences, Mitigation and Recovery Preparedness Measures 4 Risk Fault and Event Trees Likelihood and Consequence (or Effect) 8 9 9 4.4 4.5 4.3
Record Hazards and Effects

4.3.1 4.3.2 4.3.3 Records
26
26
Hazards and effects register 26 Manual of Permitted Operations (MOPO) 27
3
3.1 3.2
Hazards and Effects Management Process (HEMP) 11

The Steps in the Process Implementation of HEMP
3.2.1 3.2.2
Compare with Objectives and Performance Criteria Establish Risk Reduction Measures
4.5.1 4.5.2 General
27 27
27
11 12
Assets: planning and review 12 Activities: planning and review 13
Control of release of hazards and effects 27 Recovery preparedness measures 28
3.3
Approaches to the Hazards and Effects Management Process

3.3.1 3.3.2 3.3.3 3.3.4 Experience/judgement Checklists Codes and standards Structured review techniques
4.5.3
13
14 14 14 15
Appendix I Activities: Planning and Review HEMP Tools and Techniques Appendix II Assets: Planning and Review HEMP Tools and Techniques
30
31
EP 95-0300 Revision 0: 16 October 1995
HSE Manual EP 95-0300 Overview Hazards and Effects Management Process
Appendix III Hazards and Effects Hierarchy
33
Appendix IV Structured Review Techniques Summary Description Sheets 52 Appendix V Example of Further Definition of Consequence Severity Rating for Risk Matrix Appendix VI When to use QRA Glossary References
74 76 78 81
ii
1 Introduction
INTRODUCTION
Volume 3 of the EP HSE manual is concerned with the tools and techniques which are available to achieve the management of HSE issues. It is a first reference for all those involved in EP business activities particularly those who are responsible for the management of hazards and their effects. The objectives of Volume 3 are to: provide a general overview of the Hazards and Effects Management Process describe the tools and techniques most commonly used in Shell EP assist in the selection of the appropriate tools and techniques provide guidance on the integrated application of the tools and techniques and outline how the results are to be incorporated within the HSE Management System. This document, EP 95-0300, provides an overview of Volume 3 and describes: the need, within the context of an HSE Management System, to define both the techniques and tools commonly in use together with the competencies required for their effective application the more common terminology and concepts used in the analysis of hazards and effects and the determination of risk the stages of the Hazards and Effects Management Process and its role within the HSE Management System. The role of experience, codes and standards, checklists and structured techniques are discussed in summary the various structured review techniques available in Shell to support the process.
1.1
Elements of the HSE Management System
The HSE Management System contains the following elements which are described fully in Volume 1. Leadership and Commitment Policy and Strategic Objectives Organisation, Responsibilities, Resources, Standards and Documents Hazards and Effects Management Process (HEMP) Planning and Procedures Implementation and Monitoring Audit Review The Hazards and Effects Management Process (HEMP) is central to the effective implementation of the HSE Management System. The process ensures that hazards and potential effects are fully evaluated. To do this they must first be identified then assessed and then mitigation and recovery preparedness measures put in place to reduce the consequences of any remaining risk. To achieve this a number of tools and techniques are used. These are described in this Volume. (Specific guidance on when to use the techniques within various business activities is given in the relevant sections of Volume 2, e.g. EP 95-0230 Design, EP 95-0220 Appraisal and Development, etc.)
1.2
1.2.1
Tools for the Hazards and Effects Management Process

Selection of tools
The objectives set out in the HSE Management Systems (HSE MS) and subsequently the HSE Case effectively become the acceptance criteria for the risk determined in the hazards and effects management process. There are many publications and documents available describing tools and techniques for hazards and effects management some of which are marketed commercially. These techniques are often developed in isolation and may be inappropriate for use within EP. They may also be unnecessarily time consuming, not cost effective or may overlap. This document is designed to identify, specify and aid the effective selection of an integrated suite of tools and techniques. Most of these have been in use for some time. The various tools and techniques have been collated for ease of reference, to demonstrate their relationship to each other and to describe their input to the HSE MS and HSE Case. As stated above this document does not specify when to use the tools, this is done in the documents describing the business activities. A very broad framework of tools, techniques and guidelines used in hazards and effects identification and assessment during the life cycle is provided in Appendices I and II. Codes, standards, checklists, as well as individual experience and judgement are in no way replaced by any of these techniques and continue to play a vital role.
1.2.2
Application and competence
Successful application of a technique is largely dependent on the experience of the personnel using it. For this reason, familiarity, competence and training are important factors to be taken into consideration when planning and resourcing projects and drafting contract specifications. The competence levels required to operate these techniques effectively may then be identified and the relevant resources secured. The application of tools in the hazards and effects management process such as Environmental Assessment, Health Risk Assessment and QRA will continue to involve specialists but their output can now be brought together with other studies in a common HSE Management System. Specialist assistance when using other tools and techniques may also be necessary. However the successful application of any tool and technique will always be dependent on the participation of the staff involved in the activities under study. Most of the tools described require a multi-disciplinary approach. Health, Safety and Environmental Management is no different from any other aspect of EP business and remains a line responsibility. HSE therefore falls under the same management and management system. H, S and E have been considered together in this document although external reasons may exist for presenting certain studies separately. For example, when two separate authorities deal with safety and environmental
2 Hazards and Effects Terminology
HAZARDS AND EFFECTS TERMINOLOGY
This chapter provides an overview of the more common terminology and concepts used in the analysis of hazards and effects and the determination of risk. A comprehensive list of terms and their definitions is provided in the glossary of this document.
2.1
Hazards, Effects and Incidents
A hazard is defined as: 'The potential to cause harm, ill health or injury, damage to property, plant, products or the environment, production losses or increased liabilities'. This definition can be extended to include social/cultural disruption. This represents a specific use of the word hazard which in more common usage can mean danger, chance or risk. Risk is defined in 2.4. It is important to recognise the adopted definition of this basic term and to be consistent when using common techniques. Hazards should not be confused with hazardous activities (e.g. drilling). Examples of hazards are: hydrocarbons under pressure, objects at height , electricity. Appendix III contains a listing of generic hazards. The terms 'chronic' and 'acute' are introduced in Volume 1 and are used to differentiate between hazards and effects associated with continuous discharges and occupational exposure (prolonged) and those relating to one off events, (health, safety and environmental incidents) which might include poisoning, oil spills, fires and explosions. In environmental terms, 'chronic' effects are sometimes referred to as 'routine' and are defined as the result of planned emission or discharge to the environment. Such releases may include flaring of gas, or discharge to sea of produced water following repeated and prolonged exposure to relatively low levels or concentrations of a hazardous agent. The aim is to control all health and environmental hazards and effects within defined limits. For health, for example, controls for benzene define levels in air for long term exposure. For environment, for example, controls for flaring may include limiting the volume of gas disposed of, defining criteria for the combustion efficiency and defining environmental quality standards for combustion products. Similarly, control of noise emission will be based on noise limits which will be set for a given location. An effect in the context of this manual is usually an adverse effect either on the health or safety of employees or the public. An environmental effect is any direct or indirect impingement, whether adverse or beneficial, upon the environment of the activities, products and services of the company. This also includes impact on social and cultural systems. The undesired release of a hazard is a hazardous event. If the hazardous event is the first event resulting from the release of a hazard then it is called a 'Top Event'. This is the undesired event at the end of the fault tree and at the beginning of an event tree (see 2.5). In the context of environmental routine hazards, the undesired event can relate to the breaching of defined limits, such as oil in water discharged to sea or noise levels in and around locations, or in the context of health hazards, this relates to exceeding occupational exposure limits and other standards for the full range of agents hazardous to health. An incident is an unplanned event or chain of events which has caused or could have caused injury, illness and/or damage (loss) to assets, revenue, the environment or third parties. An incident involves the release or near release of a hazard which includes the exceedance of defined limits.
2.2
Threats and Barriers
A threat in the context of this document is something that could potentially cause the release of a hazard and result in an incident. Examples of these causes or threats are corrosion, fatigue damage, poor visibility, overpressure, lack of knowledge/competence, etc. To prevent a threat or combination of threats ultimately resulting in the release of a hazard, some kind of countermeasures are necessary. These measures are called barriers. In the case of corrosion as a threat, for example, appropriate barriers could be a corrosion-resistant coating, inspection programmes or corrosion allowances. For overpressure one barrier would be a pressure relief system. Environmental barriers could include operational controls, e.g. traffic restrictions for noise, or hardware controls, e.g. provision of water treatment equipment. Health barriers include, for example local exhaust ventilation (LEV) and PPE. Barriers may be physical (shields, isolation, separation, protective devices) or non-physical (procedures, alarm systems, training, drills).
2.3
Consequences, Mitigation and Recovery Preparedness Measures
Should the barriers fail to prevent or avoid the release of a hazard then some kind of counter measures are required to limit the consequences of the hazardous event or effect. The purpose of these countermeasures is the mitigation of consequences and to aid in reinstatement. One example of mitigation is a fixed fire protection system, another would be the evacuation of personnel from the area. Those measures aimed at reinstating or returning the situation to a normal operating condition are also called recovery preparedness measures. All such measures ranging from the first steps in mitigation through to reinstatement of the operation are termed recovery preparedness measures.

Figure 2.1 Terminology: acute or incidental release (safety example)
THREATS
Hazard : Hydrocarbon gas under pressure Examples: Corrosion Erosion Impact
ESCALATION
Pressure Vessel
Fire
Rupture and Leak
Hazardous Event
Leak !
First Hazardous Event or Top Event
Inspection Corrosion Allowance Detection Process Shutdown Detection ESD
Fire
Plant Detection Separation and Deluge
Threat Barriers
Recovery Preparedness Measures and Mitigation Measures
CAUSATION
CONSEQUENCE

Figure 2.2 Terminology: chronic or routine release (environmental example)
THREATS
ESCALATION
Ecological damage Water supply contamination Irrigation contamination Liabilities Reputation
Hazard : Effluent Examples: Input Changes Maloperation Malfunction Treatment system
Pollution
Discharge
Discharge ppm Limit Exceeded !

ppm ppm Limit
Hazardous Event Pollution

Auto Level Alarm Procedures Sampling Alarm System Shutdown Divert to Holding Tanks Plant Shutdown Clean-up Plan
Threat Barriers
CAUSATION
CONSEQUENCE

Figure 2.3 Terminology - Chronic or Routine Release (Health Example)
THREATS
ESCALATION
Hazard: Toxic vapour Examples: Corrosion Maloperation Leaking flanges
Increased risk : Leukaemia Liabilities Loss of reputation
Handling of toxic chemical
Release of benzene
Exposure to benzene exceeding OEL* !

ppm ppm Limit
Increased risk of leukaemia

Vapour Return System Procedures Local Exhaust Ventilation PPE Biological Epidemiology Monitoring
* OEL Occupational Exposure Limit
Threat Barriers
CAUSATION
CONSEQUENCE

Figure 2.4 Cause consequence diagram (bow tie)
2.4
Risk
Risk is the product of the probability that a specified undesired event will occur and the severity of the consequences of the event. To determine the risk of a specific hazardous event taking place therefore requires information on the likelihood of the event taking place and the severity of the adverse consequences that could be expected to follow from it. Risk is a term which combines the chance that a specified undesired event will occur and the severity of the consequences of the event. To determine the risk associated with a specific 'hazardous event', information is therefore required on the chance of the event taking place and the severity of the consequences that might be expected to follow from it. Risk is sometimes also defined as the product of probability and the severity of consequences. The terms 'probability', 'likelihood', 'frequency' and 'chance' are often used interchangeably however in the HEMP terminology, the following apply and should be consistently used: llikelihood and chance both indicate the possibility of something happening frequency is a rate, e.g. number of incidents per hour probability is a ratio It indicates the number of chances of something happening to the total number of chances.
2.5
Fault and Event Trees
A common way of understanding the possible threats or causes that could lead to the unplanned release of a hazard is to present them diagrammatically using a fault tree. In a similar way after the release of a hazard an event tree may be used to determine and display the potential outcomes or consequences. Fault Tree Analysis is used to show the sequence of possible threats or causes that could lead to the release of a hazard. The fault tree leads to a single point where the undesired event has taken place or where the hazard has been released. This is known in risk assessment terms as the Top Event and represents the transition from the Fault Tree (threats/causes) to the Event Tree (consequence). The Event Tree is made up of nodes which correspond to the different stages in an escalating incident sequence. The lines which lead out of each node correspond to the paths of success or failure in mitigation of the incident. The whole sequence showing the progression from any cause, (Fault Tree) through the Top Event to the full range of consequences (Event Tree), for a single hazard can be represented in a single diagram (often called a 'bow tie') as shown in Figure 2.4. In a quantitative assessment such as QRA, a number of hazards will be considered together, however in qualitative assessment it is normal to consider one hazard or one bow tie. For qualitative and quantitative risk assessment the same process is used (i.e. bow tie) but in QRA, risks are quantified initially per Top Event then summated for a number of scenarios and hazards.
2.6
Likelihood and Consequence (or Effect)
The Likelihood of a Top Event occurring may be determined by quantitative evaluation of the possible threats or from historical data bases. Lack of good data may limit the development of a fault tree however in some circumstances the historical frequency of the top event may provide an adequate timate. Consequence analysis can be applied to assess HSE aspects for a range of scenarios and typically involves the use of predictive models. Examples include the use of: physical effects models for predicting the behaviour and loading from potential hydrocarbon releases (dispersion, fire, radiation, explosion and smoke) in terms of flammable limits, heat radiation, explosion overpressure, etc physical consequence models for predicting the consequence of the effects of hydrocarbon release events (structural damage, vessel integrity loss, etc) air and water dispersion models for predicting the behaviour of discharges to the atmosphere or water bodies respectively The tools and techniques used for both likelihood and consequence analysis are described in Chapter 4.
HSE Manual EP 95-0300 Overview Hazards and Effects Management Process This page intentionally left blank
10
3 Hazards and Effects Management Process (HEMP)
3
3.1
HAZARDS AND EFFECTS MANAGEMENT PROCESS (HEMP)

The Steps in the Process
The Hazards and Effects Management Process (HEMP) was originally developed to provide a structured approach to the analysis of safety hazards throughout the life cycle of an installation. The environmental and health risk assessment processes fulfil a comparable function with respect to environmental and health hazards at all stages of the life cycle. These assessments are based on the same concept and have been brought together as HEMP. The process is applicable to all business processes in the life cycle of an operation from inception to abandonment. The tools and techniques available are applied in a logical and rigorous way, setting acceptance criteria and screening against them as the process proceeds. The arrangements identified as necessary to manage assessed threats and potential consequences and effects are then incorporated in the design phase or for existing operations it is necessary to verify that what is in place is suitable and sufficient. If not, then remedial action is taken and all necessary procedures are incorporated into the HSE Management System. The principles of 'identify', 'assess', 'control' and 'recover' are the basis of HEMP, with the individual stages summarised in the following steps: 1. 2. 3. 4. 5. Identify Hazards and Potential Effects Evaluate Risks Record Hazards and Effects Compare with Objectives and Performance Criteria Establish Risk Reduction Measures.
Step 1: Identify hazards and potential effects Systematically identify the hazards, the threats and potential hazardous events and effects which may affect, or arise from, a company's operation throughout the total life cycle of the operation. Step 2: Evaluate risks Systematically evaluate (assess) the risks from the identified hazards against accepted screening criteria, taking into account the likelihood of occurrence and the severity of any consequences to employees, assets, the environment and the public. This includes the risks associated with deviation from limits set for environmental and occupational health hazards. Step 3: Record hazards and effects Record all those hazards and effects identified as significant in relation to the screening criteria in one of the following documents: HSE MS Activities Catalogue HSE Activity Specification Sheets Hazards and Effects Register HSE Critical Operating Procedures Manual of Permitted Operations. These documents will then be included in Parts 3 and 5 of the HSE MS and HSE Case.
11
HSE Manual EP 95-0300 Overview Hazards and Effects Management Process Step 4: Compare with objectives and performance criteria Compare the evaluated risks against the detailed HSE objectives and targets for the project or installation. For all cases these targets must be maintained and be consistent with the Company Policy, and Strategic Objectives. Performance standards at all levels must meet the criteria set in the HSE Case which in turn must comply with the Company's HSE Management System. Step 5: Establish risk reduction measures Select, evaluate and implement appropriate measures to reduce or eliminate risks. Risk reduction measures include those to prevent or control incidence (i.e. reducing the probability of occurrence) and to mitigate effects (i.e. reducing the consequences). Mitigation measures include steps to prevent escalation of developing abnormal situations and to lessen adverse effects on Health, Safety and the Environment. Risk reduction measures also include recovery preparedness measures which address emergency procedures as well as restoration and compensation procedures to recover. Revisit Step 3 to record fully the activity/task requirements.
3.2
Implementation of HEMP
The Hazards and Effects Management Process can be implemented at any point in the life cycle of a facility or operation. When planning the development of new facilities, reviewing existing facilities, or planning for the abandonment and decommissioning of existing facilities the focus is on the identification and assessment of hazards and effects that may be avoided, reduced or eliminated. In the operational and maintenance phase, the focus is on control of hazards and effects by procedures and the development and implementation of effective recovery preparedness measures. In the abandonment and decommissioning stages the focus is directed towards safe clean up and rehabilitation. People involved in operational activities however should always be alert to identify new hazards particularly in non routine operations.
3.2.1
Assets: planning and review
In a new development the HEMP will normally be iterative, beginning on a wide basis with little detail and then progressing through the development cycle as more detail becomes available. In the review of an existing development a similar iterative approach may be adopted starting with a wide approach on general issues then converging on areas of specific concern and more detailed assessments. This management process is applied to all hazards and potential effects. Those engaged in design and planning activities who utilise tools, such as HAZOP, Health Risk Assessment or Environmental Assessment are already familiar with this approach. Appendices I and II give an indication of when the tools and techniques are used during the life cycle of a development and in the development of an HSE Case for an asset. Full guidance is provided in the respective business activity guidelines such as EP 95-0230 Design and Engineering and EP 950220 Concept Development. The output from the various tools and techniques used in the HEMP in the planning and review stages of a new development is used primarily to refine the design by identifying the hazards and threats, removing them if possible and making the design as inherently safe to operate as practicable. The output therefore primarily concerns the hardware although the design planning phase can profoundly affect all subsequent stages of the development. Information from this work is included in the HSE Case for an asset for use in the operational phase.
12
3 Hazards and Effects Management Process (HEMP)
3.2.2
Activities: planning and review
This relates to the preparation for practical physical activities involved in the implementation of plans. In EP these activities include survey, drilling construction, operation, decommissioning, and abandonment. This preparation should involve those carrying out or supervising the activity. The techniques for the identification and assessment of hazards used in the planning and review stages are also applicable but in the operational phase tend to be more focused on procedural aspects rather than hardware design. In the implementation or operations phase, planning activities such as the systematic preparation of Permits to Work and Job Hazard Analysis address all the steps of the HEMP. EP 95-0315 describes the basic Permit-to-Work System and EP 95-0311 describes Job Hazard Analysis which can be used for a team review of the procedure for a repeated activity or as a one-off review of a new activity. The computerised system THESIS (see EP 95-0323) can also be used to assess hazards and effects and identify the necessary controls. EP 95-0270 General Workplace Practices contains activity specification sheets and hazard register sheets for typical HSE activities and hazards encountered in the workplace. The Manual of Permitted Operation (MOPO) describes conditions where specific activities cannot be carried out at the same time and is described in EP 95-0310 Implementing and Documenting an HSE MS and HSE Case. Waste management procedures, described in EP 95-0390 Waste Management Guidelines, provide information for the inclusion of waste management activities. At the time of writing this Guide, work is proceeding on the preparation of Generic HSE Cases for activities such as drilling, seismic and transport. These are aimed at providing a basic 'starter kit' HSE case containing all the common activities, procedures and controls which can be subsequently made 'site-specific' for local application. The output from the various tools and techniques in the HEMP for operational-type activities will be used in the development and review of working procedures and form part of the HSE Case for the operation of the facility. For a significant or new activity, such as a major construction project, a seismic or drilling campaign or abandonment, the output from the various tools will be included in an HSE Case. For a smaller work scope usually confined to one contract the HSE Case is sometimes called an HSE Plan or where the work or operational task is one of many to be undertaken, terms like 'Work Procedure' or 'Work Statement' are sometimes used. All these descriptions only reflect the scale of the operation. The most important point is that in their preparation the steps of the Hazards and Effects Management Process must be followed. That is hazards and potential effects must be identified and assessed and Control and Recovery Preparedness measures must be developed and in place ahead of time.
3.3
Approaches to the Hazards and Effects Management Process
Hazards can be identified and assessed in a number of ways. The hazard identification and assessment process is based on the following: experience/judgement checklists codes and standards structural review techniques
13

Figure 3.1 Approaches to the Hazards and Effects Management Process
Structured Review Techniques
Increasing level of detail
Codes / Standards
Checklists Experience / Judgement
IDENTIFY
ASSESS
HEMP
RECOVER CONTROL
3.3.1
Experience/judgement
The knowledge of experienced staff provides a sound basis for hazard identification and assessment. One can draw on experience gained from different aspects of the EP business in different locations. Practical staff experience gained in the field and feedback from incidents, accidents and near misses is invaluable.
3.3.2
Checklists
These are a useful way of ensuring that known hazards and threats have all been identified and assessed. The use of checklists, however, must not be allowed to limit the scope of review. They are normally drawn up from standards and operational experience and focus on areas where the potential for mistakes is high or where problems have occurred in the past. Hazard Registers taken from the life cycle of previous developments are particularly useful as a basis for checklists. They should be maintained throughout the life of the development and include both the operational and abandonment phases (Ref. 1). Table VI.1 is a checklist called the Hazard Hierarchy which includes health, safety and environmental hazards previously identified by Opcos. The checklist approach is used in several techniques such as HAZID, HAZOP and FIREPRAN for example.
3.3.3
Codes and standards
These reflect collective knowledge and experience, accumulated on the basis of national or international operations. They generally focus on hazard assessment and control, since the hazard is inherent and recognisable. Codes and standards usually contain information on hazards applicable to a particular type of operation. The designer of a pressure vessel relief system, for example, can use a DEP or ISO Standard to find detailed guidance on the relief cases that should be considered. In some cases compliance with prescriptive standards alone will reduce risk to 'as low as reasonably practicable'. Similarly, the acceptability or otherwise of emissions or discharges to the environment or
14
3 Hazards and Effects Management Process (HEMP) release of agents harmful to health can be assessed by reference to environmental quality standards and occupational health exposure limits. For environmental and occupational health, the process begins with an inventory of emissions and effects agents hazardous to health respectively. Codes and standards can therefore provide guidance on all four steps of identify, assess, control and recovery. Where new or non-standard designs are concerned, especially ones containing configurations with multiple interfaces, it is unlikely that all the possible interactions can be identified using codes and standards alone. In more complex facilities such as offshore process facilities, other hazard management tools will be required.
3.3.4
Structured review techniques
The following chapters of this document describe the Structured Review Techniques and Procedures in current use. Some of these techniques were initially developed for use in safety management others have been specifically developed for environmental and occupational health management often using similar principles as for safety management. One example is HAZID (Hazard Identification) and another is HAZOP (Hazard and Operability Study). With interpretation, these techniques are also capable of addressing emissions, discharges, waste generation and occupational exposure to hazardous substances, etc. Many of the techniques described in this Volume also contain screening and acceptance criteria for Controls.
15
HSE Manual EP 95-0300 Overview Hazards and Effects Management Process This page intentionally left blank
16
4 Structured Review Techniques
STRUCTURED REVIEW TECHNIQUES
Structured review techniques are available for all phases of the 'identify, assess, control and recover' process. The recommended techniques are presented in this chapter under the same headings as used in Chapter 3, i.e.: Identify Hazards and Potential Effects Evaluate Risks Record Hazards and Effects Compare with Objectives and Performance Criteria Establish Risk Reduction Measures.
4.1
Identify Hazards and Potential Effects
The selection of the appropriate techniques depends upon the information available and the phase of the project or maturity of the operation. The development of a project is described further in Volume 2 of this manual. For EP facilities, a generic Hazards and Effects Hierarchy has been generated and is included in Appendix III. This provides a structured listing of hazards and effects and attributes which can be used as a completeness check during hazard identification. The hierarchy provides the basis for a computerised approach to the systematic identification and assessment of hazards and their effects.
Table 4.1 Technique HAZID (Hazard Identification) A structured brainstorming technique that is particularly useful in the early stages of a development, either as a stand alone exercise or as part of a more general review. The prompt or checklist approach guides the less experienced and prompts the experienced. Success when using the technique depends upon a properly constructed team being well managed and having the opportunity to think beyond the checklist and identify the unusual. The same technique can be applied for health hazards associated with the living environment (e.g. tropical diseases) and lifestyle (e.g. substance abuse). Is used for identifying and assessing occupational health hazards and the controls needed to manage them effectively. Chemical, physical, biological, ergonomic as well as psychological aspects of the occupational environment are included. Techniques for planning and review of assets Reference EP 95-0312
Health Risk Assessment
SHSEC Guide (Ref. 2) HMSO publication (Ref. 3)
Health Risk Assessment and Exposure Evaluation for Chemical Agents
Supplements the general guide on Health Risk SHSEC 1995 Assessment (Ref. 4) by providing specific (Ref. 4) additional advice on assessing risk to health arising from chemical agents in the work place.
17

Table 4.1 Technique Human Factors Encompasses a number of techniques directed at the assessment of the human element of the management of hazardous events from design through to emergency response. Includes development of an environmental profile which provides information necessary to:
Techniques for planning and review of assets (continued) Reference EP 95-0324
Environmental Assessment (EA)
EP 95-0370
build an environmental description of the area or location and its environment before development assess the beneficial and/or adverse effects of the development identify mitigation measures prepare a plan to enable measures to be implemented
Also applicable to ongoing activities. Soil and Groundwater Guides Provides guidance on assessing soil and groundwater quality at EP locations from initial desk studies to more detailed site investigations. EP 95-0385 EP 95-0386 EP 95-0387
Social Impact Assessment
Describes the component parts of a social impact EP 95-0371 assessment including relationship to the natural environment, cultural and historical attitudes and sensitivities, population characteristics and political social institutions. Means to involve the wider public are seen as critical. One of the most widely accepted and powerful of EP 95-0313 the hazard identification and assessment tools available for reviewing the design of process facilities. It is carried out in varying degrees of detail throughout a project after design checks have been completed. HAZOP is not a design tool but a supplementary team checking exercise which also includes the operational aspect of a design. It is unusual to make other than a subjective assessment of the consequences of a particular failure scenario during a HAZOP. The HAZOP technique has been extended with success by others to areas like maintenance, drilling, etc.
HAZOP (Hazard and Operability Study)
FIREPRAN
To identify deficiencies and opportunities for improvement in order to meet objectives with respect to fire and explosion management. FIREPRAN is not suited to complex, compact integrated facilities.
EP 95-0350
18

Table 4.1 Technique SAFOP (Electrical Safety and Operability Study) Comprises three components:
Techniques for planning and review of assets (continued) Reference
SAFAN - (Safety Analysis) identification of hazards to personnel in the vicinity of electrical systems SYSOP (System Operability) critical assessment of electrical network and plant design OPTAN (Operational Task Analysis) analysis of operator actions to determine areas of potential operator error.
DEP (under preparation) (Ref. 5) Refer to SIPM
There are few if any tools and techniques which are limited solely to the identification of Hazards and Potential Effects. Most include assessment as well as identification. Indeed techniques, such as Health Risk Assessment and Environmental Assessment include all four elements, identify, assess, control and recover. Inherent in some techniques, such as HAZOP, is a qualitative assessment of risk based on judgement of threats, such as hardware failure, control system failure, human error, corrosion, extreme conditions, etc.
Table 4.2 Technique Job Hazard Analysis Identification of potential problems within a job task that could lead to hazardous situations. Elimination or reduction of the hazard by development of safe working procedures. To facilitate accident or incident investigation and analysis by providing the means to assemble and manipulate investigation information into a logical structure consistent with the Tripod accident causation model and the hazards and effects model of SMS (HSE MS). The proactive identification of potential latent failures that could lead to hazardous situations and the development of remedial actions to be taken to reduce or eliminate such hazards. Techniques primarily for activity planning and review Reference EP 95-0311
Tripod-BETA
EP 95-0321
Tripod-DELTA
EP 95-0320
4.2
Evaluate Risks
Once hazards and threats have been identified, their causes, consequences and probability can be estimated and the risk determined. Risk assessment may be on a qualitative or quantitative basis both involving the same steps. Qualitative methods may be adequate for risk assessments of simple facilities or operations where the exposure of the workforce, public, environment or the asset is low. Inherent in many of the techniques mentioned in 4.1 is a subjective evaluation of risk. HAZOP and FIREPRAN, for example require the team to select the critical items for further study. To do this there must be a risk assessment which is based primarily on experience or judgement. The qualitative or banded assessment of probability and consequence from such an analysis can be plotted on the Risk Matrix described in EP 95-0100 HSE Management System and repeated in 4.2.4. In FIREPRAN, HAZOP and Health Risk Assessment, this Risk Matrix is used to assist in decisions regarding risk. In the context of this manual evaluate and assess have the same meaning. The THESIS
19
HSE Manual EP 95-0300 Overview Hazards and Effects Management Process software can also be used to assist in the hazard/risk evaluation and also uses the Risk Matrix. Guidance on when to use quantitative risk assessment is provided in the following paragraphs.
4.2.1
Scenario development (causes)
The first step in the risk evaluation is to examine the ways in which events may take place to cause a hazardous event. Causation scenarios may be developed in simple narrative or use multiple branch fault trees or utilise complex computerised modelling techniques. The method is entirely dependent on the area being assessed. For further details on scenario development refer to EP 95-0352 QRA.
4.2.2
Probability
The probability of a hazardous event occurring may be determined by evaluation of the associated possible threats and circumstances or from historical data bases. Once established, the probability of occurrence of each event can be included in a fault tree. Historical records such as those described in EP 92-1020 (Ref. 6) provide failure data for various types of event in the fault tree and event tree including the Top Event. Alternatively, probability can be generated in a qualitative way by the relative classification of probability into those shown on the Risk Matrix in 4.2.4. It is planned to replace EP 92-1020 (Ref. 6) with a data base prepared on an industry wide basis. This development is underway with the E&P Forum.
4.2.3
Consequence analysis
Consequence analysis can be applied to assess HSE aspects for a range of consequence scenarios and involves the use of predictive models. Consequence scenarios may be developed in simple narrative or use multiple branch event trees or utilise complex computerised modelling techniques. Examples include the use of physical effects models for assessing the integrity of structures, for predicting the behaviour of emissions to the atmosphere and discharge to water and predicting heat loading and explosion overpressure. Models should only be used when they are validated in a particular application and their predictive capability is generally accepted. Successful application requires that they be used by personnel with adequate training and experience. The results from Physical Effects Modelling usually provide input to other HSE analyses such as ESSA, FEA and Layout Studies. In performing consequence analyses it should be recognised that the majority of models provide only a good approximation of what might happen. It is a mistake to base design calculations wholly on model results. The designed system should be capable of withstanding the range of possible anticipated loadings.
Table 4.3 Technique Physical Effects Modelling This encompasses a number of techniques available for modelling the effects of hazardous releases such as explosions, gas dispersion and fire Offshore Layout Methodology A simplified design tool for identifying separation requirements when laying out an offshore complex EP 91-1600/1601 (Refs. 7 and 8) EP 90-2500 (Ref. 9) Techniques for consequence analysis Reference EP 95-0314
Layout Methodology
20
Onshore Layout Methodology as above for onshore facilities FEA Fire and Explosion Analysis is a collective term for the process which identifies and evaluates all fire and explosion hazardous events as a basis for risk reduction and for preparing performance criteria for essential safety systems and the arrangements required for escape, evacuation and rescue (EER). Emergency System Survivability Analysis. This is part of the FEA and determines the ability of the emergency systems to withstand severe accident conditions. ESSA is part of the FEA process and provides information which is subsequently used in TR/EERA. Temporary Refuge Escape, Evacuation and Rescue Analysis of escape to Temporary Refuge (TR), the provisions within the TR system, and the Evacuation, Escape and Rescue provisions. The analysis considers the major scenarios previously identified and compares these against respective acceptance standards highlighting critical elements and revealing any shortfalls. Used to predict the behaviour of contaminants following discharge. Results are used to evaluate the significance of emissions and discharges. A wide range of models are available and vary in complexity and sophistication.
DEP to be prepared (Ref. 10) No reference
ESSA
EXPRO Docs (Ref. 11)
TR/EERA
DEP 37.17.10.11 (Ref. 12)
Environmental Dispersion Models
Monitoring air quality EP 95-0376 Monitoring water quality EP 95-0381
Table 4.3 Technique
Techniques for consequence analysis (continued) Reference Used to predict the behaviour of marine spills and can play an important role in oil spill contingency planning. A number of models are available. A range of models available. For advice on selection and use refer to SIEP
Oil Spill trajectory Models
Risk Assessment Models for Contaminated Soil
These have been developed to evaluate the significance of soil contaminants to human and environmental health. The Human Exposure to Soil Pollutants (HESP) developed in SIPM is an example.
Env. quality standards for soil and groundwater: EP 95-0385 Setting Priorities for contaminated soil and groundwater: EP 95-0387
21
Groundwater Models
These have been developed to predict the behaviour of contaminants in groundwater and focus on the movements of the contaminants.
A range of models available. For advice on selection and use refer to SIPM
These techniques are summarised in Appendix IV.
4.2.4
Determination of risk
Having determined the probability of the different scenarios occurring to cause a 'hazardous event' and having determined the consequences arising from that event, it is possible to represent the risk graphically using the Risk Matrix described in EP 95-0100 HSE Management System and repeated below:
Table 4.4 Risk Matrix
CONSEQUENCE Severity People Assets Environment Reputation
Never heard of in EP industry
INCREASING PROBABILITY A
Has occurred in EP industry
B
has
C
Incident occurred in Opco
D
Happens several times per year in Opco
E
Happens several times per year in location
0 1 2 3 4 5
No injury Slight injury Minor injury Major injury Single fatality Multiple fatalities
No damage Slight damage Minor damage Localised damage Major damage Extensive damage
No effect Slight effect Minor effect Localised effect Major effect Massive effect
No impact Slight impact Limited impact Considerable impact National impact International impact
Manage for continuous improvement
Incorporate risk reduction measures
Intolerable
The matrix need not remain as a static display of risk and measures to be taken. Over the years tolerance to risk will change therefore the shading in the diagram will change. The above matrix gives an indication of risk tolerability but this should relate to the operation under consideration . An example of how the matrix can be further defined for a particular operation is included in Appendix V.
4.2.5
Quantitative Risk Assessment (QRA)
QRA is a potentially powerful technique which is described fully in EP 95-0352. Appendix VI contains specific examples and guidance of when Quantitative Risk Assessment is used to its best advantage. Guidelines are available for undertaking quantitative risk assessment for specific applications including risers and pipelines. These are:
22

Table 4.5 Technique ASPIN Pipeline failure risk analysis technique and data base. An easy to use quantitative failure risk assessment tool to compare different options and conditions during pipeline design and operation and to assist in optimising and planning inspection and maintenance efforts. Simplified version. QRA techniques for specific applications Reference EP 94-0101 (Ref. 13) EP 94-0102 (Ref. 14) EP 94-0195 (Ref. 15)
23
RISER
Risk Evaluation of Risers. Assessment of risks of pipeline riser on or near platforms with comparative risk analysis to assess the benefits of subsea valve installation on pipelines.
EP 90-1045 (Ref. 16)
These quantitative risk assessments should only be used by personnel with adequate training and experience. It is most important that those familiar with the operation, the facility or the design are involved in the study particularly with respect to the input, assumptions and conclusions drawn to ensure that the model reflects reality. Assumptions must reflect actual practice including inspection and maintenance frequencies and techniques, frequency of drills and operating procedures, etc. QRA provides a structured approach to assessing risk and expresses this numerically. The main function of QRA is to identify high risk areas and assist in the comparison of design options and the selection of operations philosophies with a view to establishing effective and efficient risk management. QRA assists in the determination of 'how safe is safe enough' by helping to analyse options to establish whether or not ALARP (As Low As Reasonably Practicable) has been achieved. Engineers and decision makers sometimes like to use quantitative risk assessment to make a decision for them. For this purpose they would like to see well defined acceptance criteria for risk and a calculation resulting in one number to tell them whether their design is 'right' or 'wrong'. However, risk figures which are based on probabilities should be used with caution and comparison against absolute numerical risk criteria avoided where possible. This is important for a number of reasons. First, the accuracy of QRA studies means that the comparison of calculated numbers with specified numerical criteria must be used with considerable caution. The inaccuracies are less important in comparisons between various options analysed in a consistent manner. Nevertheless absolute risk figures may be required to fulfil legislative requirements and to ascertain whether ALARP risk levels have been reached. Secondly, the risk of EP operations calculated in a QRA is often in the 'Too High' area and nowhere near the Negligible area. This means that regardless of acceptance criteria set by authorities or others, there is a need to identify further improvements and to implement them if the cost, time and effort can be justified. Thirdly, there is always the temptation to use comparison with absolute risk criteria as a means to justify not carrying out risk reduction measures, with data being manipulated solely to meet the criteria. Playing the 'numbers game' in this way could lead to QRA being used to justify risk levels that could realistically still be reduced. Fourthly, using statistical likelihood values carries with them a set of inherent assumptions which may or may not be appropriate for the operation being studied. Expressions like 'acceptably safe' or 'an acceptable risk' should be avoided when discussing risk. Risks are never acceptable when the benefits of an activity are perceived to be smaller than the risks. Further, a risk is never considered acceptable while there are effective alternatives to lower it. If there
24
4 Structured Review Techniques are no effective alternatives or the cost of further reduction is disproportionate then it may be necessary to live with or 'tolerate' the risk. QRA can be used to assess risk to the company's workforce, assets and environment as well as risk to the public. At present, QRA or environmental QRA is confined to 'incidental' or 'acute' hazardous events. In EP operations, the facilities are in many cases sufficiently remote that considerations of this type of risk to the public do not dominate. In downstream activities, risk to the public is often the main concern. The application of QRA is not necessarily limited to large, complex and expensive studies. It is a technique which can be used relatively quickly and cheaply to help to structure the solution to problems for which the solution is not intuitively obvious. Without the quantification of risk in some situations, there may a danger of allocating scarce resources for little benefit. Risk is often defined as a function of the chance that a specified undesired event will occur and the severity of the consequences of the event. For QRA purposes, chance can be expressed as frequency or probability of an occurrence. If no attempt is made to estimate the chance, we may be driven by the consequence into investing heavily on risk reduction measures which are ineffective. This is illustrated in Figure 4.1. The risk curve (shaded) indicates the area in which effective risk reduction measures can be taken.
Figure 4.1 Determination of risk
On the left side of the curve the consequences are too small to cause concern, regardless of the probability. On the right side the consequences could be dramatic but the probability is so low that it would be more effective to invest in those risk reduction measures which concentrate on the events contributing to the peak of the risk curve. The above can be easily aligned with the Risk Matrix. It must be recognised that the public and regulatory authorities are most interested in high consequence events. In the context of the Risk Matrix this might be in the 'never heard of incident in EP industry' column but nevertheless risk reduction measures must still be considered.
25
4.2.6
Screening criteria: limits/standards
EP 95-0100 HSE Management Systems Chapter 4 describes the concept of screening risk against criteria set in a qualitative and quantitative manner together with the use of the ALARP principle, which sets the risk level as low as reasonably practicable. Guidelines which provide environmental limits and standards include: EP 95-0375 EP 95-0380 EP 95-0385 Environmental quality standards - air Environmental quality standards - water Environmental quality standards - soil and groundwater
References to occupational exposure limits and standards are listed in Health Risk Assessment (Ref. 2) and Ionising Radiation Safety Guide (Ref. 17).
4.3
4.3.1
Record Hazards and Effects

Records
The documentation relating to the hazards and effects analysis and the management of hazards and effects is included in Parts 3 and 5 of the HSE MS and HSE Case described in EP 95-0310. In a major project or facility the studies carried out as part of the HEMP are recorded formally usually via the first draft of the Hazards and Effects Register. The level of detail addressed increases as familiarity with the project or facility improves. Different techniques are then applied to identify and assess hazards. The hazards and control measures identified during the design phase are recorded for later transfer to the operator of the facility who will be responsible for the HSE Case. A PC based tool developed to do this is THESIS described in EP 95-0323.
4.3.2
Hazards and effects register
The hazards and effects information gained from the application of HEMP tools and techniques is incorporated in the HSE Case in what is called a Hazards and Effects Register. The HSE Case has to demonstrate that: all hazards, effects and threats have been identified the likelihood and consequences of a hazardous event have been assessed that controls to manage potential causes (threat barriers) are in place that recovery preparedness measures to mitigate potential consequences have been taken. Assembly of the Hazards and Effects Register, which forms part of the HSE Case, begins at the design and development stage of a project when hazards and effects from this phase are incorporated. Hazards applicable during the construction and commissioning phase may be included or listed separately. Later, hazards encountered in the operations and maintenance phase are included. The Hazards and Effects Register is a live document and is passed from phase to phase of a development through to abandonment. When the design phase is complete, the Hazards and Effects Register is handed over to and subsequently maintained by, the operations management of a facility. The Hazards and Effects Register will subsequently be used in the planning of abandonment and held on record for a period thereafter.
26
4.3.3
Manual of Permitted Operations (MOPO)
Once the Hazards and Effects Register is completed it is possible to complete a Manual of Permitted Operations which defines: the level and number of barriers installed initially and the recovery preparedness measures to be in place the limit of safe operation if the barriers and/or recovery preparedness measures (sometimes referred to as the 'Integrity Envelope') are reduced, removed or purposely defeated the limit of safe operation permitted during periods of escalated risk, in either likelihood or consequence. This includes external factors like extreme weather conditions which activities may or may not be carried out concurrently, e.g. simultaneous welding and crude sampling. Further details on the preparation of a MOPO are given in EP 95-0310 Implementing and Documenting on HSE MS and HSE Case.
4.4
Compare with Objectives and Performance Criteria
The objectives and performance criteria adopted at all levels in the process should comply with those stated in the Corporate HSE Policy, HSE MS and HSE Case, respectively (see EP 95-0100 HSE Management Systems Chapter 4).
4.5
4.5.1
Establish Risk Reduction Measures

General
Risk reduction measures include preventative measures (likelihood reducing) and mitigatory measures (consequence reducing). As described in EP 95-0100, the point at which measures may be classified as prevention, mitigation or recovery can sometimes become unclear depending on the perspective of what constitutes the hazardous event. Fortunately, in practice, this makes little or no difference to the process of risk reduction. Control and recovery aspects form a significant part of design standards. These are not listed separately in this document. A number of reference documents describing the controls are frequently used in applying the HEMP. These are summarised below together with references for full descriptions.
4.5.2
Control of release of hazards and effects
Some typical control measures are described in the following guidelines: EP HSE Manual: EP 95-0376 EP 95-0381 EP 95-0386 EP 95-0390 EP 95-0391 Monitoring Air Quality Monitoring Water Quality Monitoring Soil and Groundwater Quality Waste Management Guidelines Classifying Waste
27
HSE Manual EP 95-0300 Overview Hazards and Effects Management Process EP 95-0270 EP 95-0315 EP 95-0317 All SHC and SHSEC DEPs Codes and standards General Workplace Practices Guidelines on Permit to Work (PTW) Systems Hydrogen Sulphide (H2S) in Operations guidelines e.g. Noise Guide, Asbestos, Ionising Radiation, Heat and Cold Stress Refer to Index DEP Publications and Standard Specifications DEP 00.00.05.05 Gen. (Ref. 18)
4.5.3
Recovery preparedness measures
Recovery from the consequences of the release of a hazard requires careful planning. Even with a comprehensive range of controls in place to prevent the release of hazards or effects things can still go wrong. It is important that all personnel involved are fully briefed and drilled as to the response measures planned which may include evacuation and restoration procedures. Recovery Preparedness Measures include active, passive and operational (contingency plans) response arrangements. In a crude oil separation module a loss of containment will probably be controlled by ESD, depressurisation and containment/fire protection devices. These control and recovery measures have been installed to achieve the HSE objectives that have been set. They might reduce a worst case occurrence to a single major injury or fatality as compared with the possible catastrophe that could have occurred with no controls at all in place. From an environmental perspective recovery includes site clean up and rehabilitation. An example in occupational health would be the redeployment of a radiographer who has exceeded his radiation exposure or a cargo handler who has a back injury. Documents which will assist in the development of recovery procedures include amongst others: EP 95-0316 DEP 37.17.10.11-Gen EP 95-0397 EP 95-0387 EP 95-0351 SHSEC 1994 HSE 94023 Jan 1995 HSE 94023a Jan 1995 E&P Forum DEPs Codes and standards Emergency Response Design of Offshore Temporary Refuges (Ref. 12) Oil Spill Dispersants Contaminated Soil and Groundwater Fire Control and Recovery Medical Emergency Guidelines for Management (Ref. 19) Medical Emergency Guidelines for Health Care Professionals and First Aiders (Ref. 20) Guidance to First Aiders (Ref. 21) Standards for Clinical Services (Ref. 22) For index refer to Index DEP Publications and Standard Specifications DEP 00.00.05.05-Gen. (Ref. 18)
28
4 Structured Review Techniques This page intentionally left blank
29
APPENDIX I ACTIVITIES: PLANNING AND REVIEW HEMP TOOLS AND TECHNIQUES

In the EP Business Model (EPBM) Version 3 (Ref. 23) the activity grouping (ACT) 'Managing Activities' applies equally to all activities including those shown below against the life cycle. In the 'Establishment of Business Controls' (ACT-01-06), the controls to manage HSE risk are addressed in an HSE Case. The broad HSE objectives to be met in the activities: establishment of business controls (ACT-01-06), 'planning' (ACT-01-08) and 'monitoring/control during execution' (ACT-03-02) are bulletised on the left of the table below. Some of the tools and techniques available are listed on the right.
produce and maintain
explore
Execute Surveys
appraise
develop
abandon
Drilling Appraisal and Development Design Construction
Drilling
Commissioning Production and Maintenance Decommissioning Logistics
objectives
MANAGE ACTIVITIES (ACT) Includes: HSE Case for Specific Activities

Establish Business Controls (ACT-01-06)
eg Prepare HSE Case for specific activities such as: survey, drilling, operations, logistics HAZID demonstrate that risks Generic HSE Cases (under development) associated with the activity Health Risk Assessment are managed Environmental Assessment Job Hazard Analysis Permit-to-Work H2 S Fire Control and Recovery Safe Handling of Chemicals (SDS) Human Factors Emergency Response (including oil spill plans), Oil Spill Dispersants Contaminated Soil and Groundwater Classification of Waste Waste Management
Prepare Plan (ACT-01-08) ensure contracting strategy

reflects known risks
eg. Prepare Execution Plan HAZID
Monitor and Control Activity Execution (ACT-03-02) Environmental Monitoring/Standards identify and manage any
additional hazards and threats Job Hazard Analysis Tripod - DELTA Tripod - BETA
HSE CASE FOR ACTIVITY

HAZARDS AND EFFECTS REGISTER
30
Appendix II Assets : Planning and Review HEMP Tools and Techniques
APPENDIX II ASSETS: PLANNING AND REVIEW HEMP TOOLS AND TECHNIQUES

The activities (Ref. 23) described in this appendix encompass the life cycle of an asset. The HSE Case which is prepared during the execution of these activities becomes the HSE Case for the asset and forms part of the Asset Reference Plan. The broad HSE objectives are bulletised on the left of the table. Some of the tools and techniques available are listed on the right.
ACQUIRE OR DIVEST ASSET (A16) Evaluate/Value Asset or Divestment (A16-01-02) HAZID identify major hazards identify environmental Environmental Assessment (preliminary)
effects and sensitivities together with history of past practices objectives
EVOLVE DEVELOPMENT CONCEPTS (A11) Make Facility Design Concepts (A11-04-02) identify major project HAZID
hazards
Carry out HSE Analysis (A11-04-05)

obtain assurance of manageability Qualitative comparison of risk based on judgement or coarse QRA if significant global risks or high level of innovation Environmental Assessment, Health Risk Assessment
Evaluate Concepts (A11-05) obtain an assessment and QRA (Comparative or coarse)

comparison of HSE risks between options Environmental Assessment (update)
Propose Development Concepts (A11-06)

finalise option selection with due regard for HSE review hazards within option obtain agreement for philosophies of: Operations and Maintenance; Fire and Explosion QRA (comparative or coarse) Environmental Assessment (update) HAZID
DESIGN, CONSTRUCT, MODIFY OR ABANDON FACILITIES (A12) Prepare Conceptual Design (A12-01)
ensure technical integrity of basic process develop layout to minimise consequences in developing the 'Project Specification' review technical integrity of detailed process minimise risk of escalation
-for offshore and complex plant -for less complex and onshore
(Validate 'Basis for Design')
HAZOP (coarse) Coarse Layout Methodology Human Factors HAZOP (detailed) Instrumented Protection Function (IPF) classification Detailed Layout Methodology, Fire and Explosion Analysis Emergency System Survivability Analysis FIREPRAN Escape, Evacuation and Rescue Analysis (use judgement for less complex plant) QRA (as necessary) HAZID Health Risk Assessment, Human Factors, Environmental Assessment
ensure adequate provision for escape review overall risks minimise construction risks incorporate HSE-specific requirements
HSE CASE FOR ASSET

31

objectives
DESIGN, CONSTRUCT, MODIFY OR ABANDON FACILITIES (A12) cont'd)
Prepare Detailed Design (A12-02)

ensure change does not impair technical integrity prepare input for HSE Case for facility QRA HAZOP Instrumented Protection Function (IPF) classification see ACT-01-06
Construct and Precommission Facility (A12-03) HSE risk managed in Prepare activity HSE Case Plan (see ACT-01-06) ensure construction Commission Facility (A12-04) Pre-startup audit verify readiness to startup Abandon Facility (A12-05) ensure legal and social
obligations met with respect to environment decommission and remove safely with due care for health and environment Prepare plan (ACT-01-06) HAZID Environmental Assessment (including review of past practices and liabilities), Health Risk Assessment HAZID Environmental Assessment Health Risk Assessment
DESIGN, CONSTRUCT, MODIFY OR ABANDON WELLS (A09)

(as for A12 for Wells)
OPERATE AND MAINTAIN FACILITIES AND WELLS (A71/A72)

(see under HSE Case for Asset)
MANAGE ASSETS (ASS)

(Includes HSE Case for Asset)
Asset Reference Plan (ASS-01-02) HAZID demonstrate that risks

associated with asset and its operation are managed
Health Risk Assessment Environmental Assessment Job Hazard Analysis Permit-to-Work Instrumented Protection Function (IPF) classification H2 S Fire Control and Recovery Safe Handling of Chemicals (SDS) Human Factors Emergency Response (including oil spill plans) Oil Spill Dispersants Contaminated Soil and Groundwater Classification of Waste Waste Management
Appraise Asset Integrity (ASS-04-02) Process Hazard Review confirm process integrity and HAZOP containment FIREPRAN compare fire and explosion
provisions against objectives set
HSE CASE FOR ASSET

32
Appendix III Hazards and Effects Hierarchy This page intentionally left blank
33
APPENDIX III HAZARDS AND EFFECTS HIERARCHY

The Hazards and Effects Hierarchy is a structured list of HSE-related hazards and effects that may occur in the EP business. It can provide a starting point in hazard identification (the first step of the Hazards and Effects Management Process, HEMP). Use of the Hazards and Effects Hierarchy as a checklist gives greater assurance that all hazards and effects have been addressed and identification and initial assessment is complete. The Hazards and Effects Hierarchy is a structured checklist incorporated in the PC-based tool THESIS (EP 95-0323). It is continually being improved with use in different operations and environments. The hierarchy in the attached Table III.1 is therefore only included as an example or 'snapshot'. For the most up-to-date version, refer to the latest version of THESIS software. In THESIS each hazard and effect has been assigned a number which has been consistently carried through to the Hazards and Effects Register. The same numbering system is used here. The Hazards and Effects Hierarchy, Table III.1, consists of main hazard groups such as H-01 Hydrocarbons. Under these are sub-groupings, such as H-01.06 Hydrocarbon Gas. Some examples are given of typical sources of these hazards or locations where they will be found. Under the three columns 'Safety', 'Health' and 'Environment' an arbitrary coding has been given which has been found useful in grouping hazards. The reason for the Health grouping is explained below. Any other coding or tagging can be used. No attempt has been made to link the listing of hazards with, for example business activities or types of facilities, since any one hazard can invariably be present in many situations. The Hazards and Effects Hierarchy nevertheless lends itself to use as part of a systematised approach to hazard management.
III.1
Routine Health Hazards and Effects
Health hazards encountered in the work place and by the public are usually divided into the following five broad groups: chemical hazards physical hazards such as noise, vibration, ionising radiation biological hazards such as micro-organisms ergonomic hazards such as manual handling psychological hazards such as stress life style such as substance abuse living environment such as malaria and environmental pollution The Hazards and Effects Hierarchy as presented in this appendix can be sorted to cover all significant health hazards and effects in this order or any other order that is required.
III.2
Environmental Hazards and Effects
Effects on the environment may be due to unintentional incidents (e.g. a fire or chemical spill) or due to intended often continuous, routine or chronic releases as part of the operation.
34
Appendix III Hazards and Effects Hierarchy The Hazards and Effects Hierarchy listing, Table III.1, is valid for both incidental releases and routine releases. As described in 2.1, a hazardous event in the case of the routine or chronic release is when defined limits have been exceeded. A hazardous event in the case of an acute or incidental release is an occurrence or incident. Limits should be defined for routine releases which have an adverse effect on the environment. Reviewers often find it easier to think in terms of sources of environmental effects. To assist in this identification Table III.1 is a checklist of sources, of environmental hazards and of potential effects. This table can assist in the identification of hazards and effects when reviewing a proposed development or operation (i.e. in the Environmental Assessment process) or when reviewing effects from the existing operation and preparing reduction plans. The list is not complete and any further additions to the checklist should be forwarded to SIEP. Currently, three types of environmental hazards have been identified: hazards associated with discharges or emissions hazards/effects from use of natural resources hazards causing effects from presence. It is not always possible to pinpoint a genuine hazard causing the effect, e.g. resource use can result from a number of activities.
Key to Hazards
Table III.1 Safety Hazards F = Flammable MH = Major Hazard Se = Security Hazard WP = Work Practice The Hazards and Effects Hierarchy Health Hazards B = Biological Agent C = Chemical Agent E = Ergonomic Agent P = Physical Agent LS = Life Style Agent Psy = Psychological Agent M = Medical Issue Environmental Hazards D= Discharge Hazards R = Use of Natural Resources Pr = Presence
Hazard Number H-01 H-01.01 H-01.02
Hazard Description Hydrocarbons Crude oil under pressure Hydrocarbons in formation
Safety
Health
Enviro
Sources
MH MH
D D
Flowlines, pipelines, pressure vessels and piping Oil wells especially during well drilling and entry/workover operations
35
H-01.03
LPGs (e.g. Propane)
MH
Process fractionating equipment, storage tanks, transport trucks and rail cars Cryogenic plants, tankers Gas wells, gas pipelines, gas separation vessels Oil/gas separators, gas processing plants, compressors, gas pipelines Oil storage tanks Filter separators, well tubulars, pipelines Fuel source, mining activities
H-01.04 H-01.05 H-01.06
LNGs Condensate, NGL Hydrocarbon gas
MH MH MH
C C C
D D D
H-01.07 H-01.08 H-01.09 H-02 H-02.01 H-02.02 H-02 H-02.03 H-02.04 H-03 H-03.01 H-03.02
Crude oil at low pressures Wax Coal Refined Hydrocarbons Lube and seal oil Hydraulic oil
MH F F
C C P
D D R
C C
D D
Engines and rotating equipment Hydraulic pistons, hydraulic reservoirs and pumps
Refined Hydrocarbons (cont'd) Diesel fuel Petroleum spirit/gasoline Other flammable materials Cellulosic materials Pyrophoric materials F F C D Packing materials, wood planks, paper rubbish Metal scale from vessels in sour service, scale on filters in sour service, iron sponge sweetening units F C C D D Vehicle fuelling stations, vehicle maintenance Vehicle fuelling stations, vehicle maintenance
36
Hazard Number H-04 H-04.01 H-04.02 H-04.03
Hazard Description Explosives Detonators Conventional explosive material Perforating gun charges
Safety
Health
Enviro
Sources
WP MH MH
C C Pr
Seismic Operations, pipeline construction Seismic Operations, pipeline construction Well completion activities associated with drilling rigs and workover operations
H-05 H-05.01
Pressure Hazards Bottled gases under pressure WP Welding and metal cutting operations, laboratory gas sources Water disposal, water floods and injection operations, strength testing of pipeworks, well fracturing and treatments Purging and leak testing of facilities Seismic air guns and related piping, P P Undersea operations Undersea operations
H-05.02
Water under pressure in pipeworks
WP
H-05.03 H-05.04 H-05.05 H-05.06 H-06 H-06.01
Non-hydrocarbon gas under pressure in pipeworks Air under high pressure Hyperbaric Operations (diving) Decompression (diving)
MH WP WP WP
Hazards associated with differences in height Personnel at height >2m MH Work involving scaffolding, suspended access, ladders, platforms, excavations, towers, stacks, roofing, working overboard, working on monkey board
H-06 H-06.02
Hazards associated with differences in height (cont'd) Personnel at height <2m WP Slippery/uneven surfaces, climbing/descending stairs, obstructions, loose grating Objects falling while being lifted/handled or working at a height over people, equipment or process systems, elevated work platforms, slung loads
H-06.03
Overhead equipment
MH
37
Hazard Number H-06.04 H-06.05 H-07 H-07.01
Hazard Description Personnel under water Personnel below grade Objects under induced stress Objects under tension
Safety MH WP
Health
Enviro
Sources Objects falling on to divers from operations overhead Pipeline trenches, excavations, repairing buried facilities
WP
Guy & support cables, anchor chains, tow & barge tie-off ropes, slings Spring-loaded devices such as relief valves and actuators and hydraulically operated devices
H-07.02
Objects under compression
WP
H-08 H-08.01
Dynamic situation hazards On land transport (driving) WP Driving to and from locations and camps, transporting materials, supplies and products, seismic operations, moving drilling rigs and workover rigs Boat transport to and from locations and camps, transporting materials, supplies and products, marine seismic operations, barges moving drilling rigs and workover rigs Helicopter and fixed wing travel to and from locations and camps, transporting materials, supplies and products Shipping lane traffic, product transport vessels, supply and maintenance barges and boats, drifting boats Engines, motors, compressors, drill stems, thrusters on DP Ships
H-08.02
On water transport (boating)
WP
H-08.03
In air transport (flying)
MH
H-08.04
Boat collision hazard to other MH vessels and offshore structures
H-08.05
Equipment with moving or rotating parts
WP
H-08 H-08.06
Dynamic situation hazards (cont'd) Use of hazardous hand tools (grinding, sawing) Use of knives, machetes and other sharp objects WP Workshop, construction sites, maintenance sites, rotating equipment Galley, seismic line clearing, grubbing operations Basket transfer, rope transfer
H-08.07 H-08.08
WP
Transfer from boat to offshore WP platform
38
Hazard Number H-09 H-09.01 H-09.02 H-09.03 H-10 H-10.01
Hazard Description Environmental Hazards Weather Sea state/river currents Tectonic Hot surfaces
Safety
Health
Enviro
Sources
WP MH MH
Winds, temperature extremes, rain, etc Waves, tides or other sea states, river currents Earthquakes or other earth movement activity
Process piping and equipment WP between 60 and 150 deg. C Process piping and equipment MH over 150 deg. C Engine and turbine exhaust systems WP
Oilwell piping, piping in fractionation systems, glycol regeneration Hot oil piping, piping associated with stills and reboilers Power generation, gas compression, refrigeration compression, engine driven equipment such as forklifts Sulphur plants, power boilers, waste heat recovery systems, heat tracing and jackets
H-10.02 H-10.03
P P
H-10.04
Steam piping
WP
H-11 H-11.01
Hot fluids Temperatures between 100 and 150 deg. C WP P Glycol regeneration, low quality steam systems, cooling oils, galley Power boilers, steam generators, sulphur plants, waste heat recovery units, hot oil heating systems, regeneration gases used with catalysts and desiccants
H-11.02
Temperatures greater than 150 MH deg. C
H-12 H-12.01
Cold surfaces Process piping between -25 deg. C and -80 deg. C MH P Cold ambient climate, JouleThomson expansions (process and leaks), propane refrigeration systems, LPG gas plants Cryogenic plants, LNG plants, LNG storage vessels including tankers, vapour lines off liquid nitrogen storage
H-12.02
Process piping less than - -80 deg. C
MH
H-13 H-13.01
Cold fluids Oceans, seas and lakes less than 10 deg. C P North Sea, Arctic Ocean
39
Hazard Number H-14 H-14.01
Hazard Description Open flame Heaters with fire tube
Safety
Health
Enviro
Sources
Glycol reboilers, amine reboilers, salt bath heaters, water bath heaters (line heaters) Hot oil furnace, Claus plant reaction furnace, catalyst and desiccant regeneration gas heaters, incinerators, power boilers Pressure relief and blowdown systems
H-14.02
Direct fired furnaces
H-14.03 H-15 H-15.01
Flares Electricity Voltage > 50 to 440 V in cables Voltage > 50 to 440 V in equipment MH
Power cables, temporary electrical lines on construction sites Electric motors, electric switchgear, power generation, welding machines, transformer secondary Overhead power lines, power generation, transformer primary, large electrical motors Major lightning-prone areas Non-metallic storage vessels and piping, product transfer hoses, wiping rags, unearthed equipment, aluminium/steel, high velocity gas discharges
H-15.02
WP
H-15.03
Voltage >440 V
MH
H-15.04 H-15.05
Lightning discharge Electrostatic energy
WP WP
H-16 H-16.01 H-16 H-16.02 H-16.03 H-16.04 H-16.05
Electromagnetic radiation Ultraviolet radiation Electromagnetic radiation (cont'd) Infra-red radiation Microwaves Lasers E/M radiation : high voltage ac cables P P P P Flares Galley Instrumentation, surveying Transformers, power cables P Arc welding, sunshine
40
Hazard Description
Safety
Health
Enviro
Sources
Ionising radiation - open source Alpha, beta - open source P D Well logging, radiography, densitometers, interface instruments Well logging, radiography Well logging Scales in tubulars, vessels and process plant fluids (especially in C3 reflux streams)
H-17.02 H-17.03 H-17.04
Gamma rays - open source Neutron - open source Naturally occurring ionising radiation Ionising radiation - closed source Alpha, beta - closed source
P P P
D D D
H-18 H-18.01
Well logging, radiography, densitometers, interface instruments Well logging, radiography Well logging
H-18.02 H-18.03 H-19 H-19.01 H-19.02
Gamma rays - closed source Neutron - closed source Asphyxiates Insufficient oxygen atmospheres Excessive CO2
P P
C C D
Confined spaces, tanks Areas with CO2 firefighting systems such as turbine enclosures Working overboard, marine seismic operations, water transport N2 purged vessels D Areas with halon firefighting systems such as turbine enclosures and electrical switchgear and battery rooms Welding/burning operations, fires
H-19.03
Drowning
H-19.04 H-19.05
Excessive N2 Halon
C C
H-19.06 H-20 H-20.01
Smoke Toxic gas H2S (hydrogen sulphide, sour MH gas)
Sour gas production, bacterial activity in stagnant water, confined spaces in sour operations
41
Hazard Description Toxic gas (cont'd) Exhaust fumes
Safety
Health
Enviro
Sources
Sleeping in cars with running engines, heating devices, car garage Component of H2S flare and incinerator flue gas Component of crude oil, concentrated in glycol vent emissions and Wemco units Water treatment facilities Construction and metal fabrication/repair, welding toxic metals (galvanised steel, cadmium-coated steel), metal cutting, grinding Accommodation, office buildings, inside cars, boats, helicopters, aeroplanes
H-20.03 H-20.04
SO2 Benzene
C C
D D
H-20.05 H-20.06
Chlorine Welding fumes
MH
C C
H-20.07
Tobacco smoke
LS
H-20.08 H-21 H-21.01 H-21.02 H-21.03 H-21.04 H-21.05 H-21.06 H-21.07 H-21.08 H-21.09 H-21.10 H-21.11 H-21.12 H-21.13 H-21.14
CFCs Toxic liquid Mercury PCBs Biocide (gluteraldehyde) Methanol Brines Glycols Degreasers (terpenes) Isocyanates Sulphanol Amines Corrosion inhibitors Scale inhibitors Liquid mud additives Odorant additives (mercaptans) C C C C C C C C C C C C C C
Air conditioning, refrigeration, aerosol sprays
D D D D D D D D D D D D D D
Electrical switches, gas filters Transformer cooling oils Water treatment systems Gas drying and hydrate control Hydrocarbon production, well kill fluid, packer fluids Gas drying and hydrate control Maintenance shops Two-pack paint systems Gas sweetening Gas sweetening Additive to pipelines and oil/gas wells, chromates, phosphates Cooling and injection water additive Drilling fluid additive Custody transfer facilities for gas, LPG and LNG
42
Hazard Number H-21.15 H-21.16 H-21.17
Hazard Description
Safety
Health LS LS C
Enviro
Sources
Alcohol-containing beverages WP Recreational drugs Used engine oils (polycyclicaromatic hydrocarbons) Carbon tetrachloride Grey and/or Black Water Toxic solid Asbestos WP
Used engine oils
H-21.18 H-21.19 H-22 H-22.01
Plant laboratory Septic systems, camps, detergents
Thermal insulation and construction materials, old roofing (encountered during removal) Thermal insulation and construction material Oil well and gas well cementing, civil construction Drilling fluid additive Drilling fluid additive Sulphur recovery plants Pipeline cleaning operations Oil and gas well drilling Oil and gas well drilling Oil and gas well drilling Oil and gas well drilling, plant construction Cutting brickwork and concrete, driving on unpaved roads, carpenter shops, grit blasting, sand blasting, catalyst (dumping, screening, removal, drumming)
H-22.02 H-22.03 H-22.04 H-22.05 H-22.06 H-22.07 H-22.08 H-22.09 H-22.10 H-22.11 H-22.12
Man-made mineral fibre Cement dust Sodium hypochlorite Powdered mud additives Sulphur dust Pig trash Oil-based muds Pseudo-oil-based muds Water-based muds Cement slurries Dusts
C C C C C C C C C C C
D D D D D D D D D D
H-22.13 H-22.14 H-23 H-23.01 H-23.02
Cadmium compounds and other heavy metals Oil based sludges Corrosive substances Hydrofluoric acid Hydrochloric acid WP WP
C C
D D
Welding fumes, handling coated bolts Oil storage tank cleaning
C C
D D
Well stimulation Well stimulation
43
Hazard Number H-23 H-23.03 H-23.04 H-24 H-24.01
Hazard Description Corrosive substances (cont'd) Sulphuric acid Caustic soda (sodium hydroxide) Biological hazards Poisonous plants (poison ivy and oak, stinging nettles, nightshade) Large animals (dogs, cats, rats, African wild animals) Small animals (snakes, scorpions, lizards) Food-borne bacteria (e.g. E. Coli) Water-borne bacteria (e.g. Legionella) Parasitic insects (pin worms, bed bugs, lice, fleas) Disease transmitting insects (mosquitoes-malaria and yellow fever, ticks-lime disease, fleas-plague) Cold and Flu Virus Human Immune deficiency Virus (HIV) Other Communicable Diseases Ergonomic hazards Manual materials handling
Safety
Health
Enviro
Sources
WP
C C
D D
Wet batteries, regenerant for reverse osmosis water makers Drilling fluid additive
Natural environment
H-24.02 H-24.03 H-24.04 H-24.05 H-24.06
B B B B B
Natural environment Natural environment Contaminated food Cooling systems, domestic water systems Improperly cleaned food, hands, clothing, living sites (pin worms, bed bugs, lice, fleas ) Natural environment
H-24.07
H-24.08 H-24.09 H-24.10 H-25 H-25.01
B B B
Other people Contaminated blood, blood products and other body fluids Other people
Pipe handling on drill floor, sack handling in sack store, manoeuvring equipment in awkward locations Pr Pr Releases from relief valves, pressure control valves Engine rooms, compressor rooms, drilling brake, air tools Near flare, on the monkey board under certain conditions, in open exposed areas in certain regions of the world during summer
H-25.02 H-25.03 H-25.04
Damaging noise Loud steady noise > 85 dBA Heat stress (high ambient temperatures)
WP
P P P
44
Hazard Description Ergonomic hazards (cont'd) Cold stress (low ambient temperatures) High humidity
Safety
Health
Enviro
Sources
Open areas in winter in cold climates, refrigerated storage areas Climates where sweat evaporation rates are too low to cool the human body, personal protective clothing Pr Hand-tool vibration, maintenance and construction worker, boating Poorly designed office furniture and poorly laid out workstations Pr Work areas requiring intense light, glare, lack of contrast, insufficient light Controls poorly positioned in workplace requiring workers to exert excessive force, lacking proper labels, hand-operated control valves, for example in driller house, heavy machinery, control rooms Machinery difficult to maintain regularly due to their awkward positioning, for example valves in an usually high or low position Requiring older workers to maintain a high physical level of activity over the course of an 8/12 hour day, heavy construction work performed by slight individuals Requiring individuals to monitor a process without trying to reduce their boredom by giving them a higher task load, asking a worker to supervise something he/she is not qualified Offshore locations utilising long shift cycles, overtime, night shifts, rollover shifts
H-25.06
H-25.07
Vibration
H-25.08 H-25.09
Workstations Lighting
E P
H-25.10
Incompatible hand controls
H-25.11
Awkward location of workplaces and machinery
H-25.12
Mismatch of work to physical abilities
H-25.13
Mismatch of work to cognitive abilities
H-25.14
Long and irregular working hours/shifts
45
Hazard Description Ergonomic hazards (cont'd) Poor organisation and job design
Safety
Health
Enviro
Sources
Ambiguity of job requirements, unclear reporting relationships, over/under supervision, poor operator/contractor interfaces Work overload, unrealistic targets, lack of clear planning, poor communications Uncomfortable climate for permanently manned areas
H-25.16
Work planning issues
H-25.17 H-26 H-26.01
Indoor climate (too hot/ cold/ dry/ humid, draughty) Psychological hazards Living on the job/away from family
Psy
Homesickness, missing family and social events, unable to be involved in community, feeling of isolation and losing chunks of life. Drifting away from spouse and family, development of different interests and friends, threatened by spouse's independence, wind-down period at start of break. Inability to support spouse in domestic crisis. Difficult to turn off in leisure time Awareness that mistakes can be catastrophic, vulnerable to the mistakes of others, responsible for the safety of others. Awareness of difficulty of escape in an emergency. Awareness of risks in helicopter travel, adverse weather. Serious incidents, injuries to self and others
H-26.02
Working and living on a live plant
Psy
H-26.03 H-27 H-27.01 H-27.02 H-27.03 H-27.04 H-27.05
Post traumatic stress Security related Hazards Piracy Assault Sabotage Crisis (military action, civil disturbances, terrorism) Theft, pilferage Se Se Se Se Se
Psy
46
Hazard Description Use of Natural Resources Land
Safety
Health
Enviro
Sources
Installation sites, drilling locations, seismic clearing, pipeline right-of-ways Cooling water Turbines, combustion engines (cars, trucks, pump and compressor drivers) Installation sites, seismic clearing, pipeline right-of-ways, drilling locations Borrow pits, road construction
H-28.02 H-28.03
Water Air
R R
H-28.04
Trees, vegetation
H-28.05 H-29 H-29.01 H-29.02
Gravel Medical Medical unfitness Motion sickness M M
Medically unfit staff for the task Crew change on water, marine operations
47

Table III.2
Source* Flare
Checklist of sources - hazards - effects

ROUTINE HAZARDS CH4 SOx NOx N2O CO2 CO noise light H2S odorous compounds particulates radiation heat trace toxics metals - PAH POTENTIAL EFFECTS global warming/climate change/atmospheric ozone increase acid deposition, water and soil acidification atmospheric ozone increase/acid deposition global warming/stratosphere ozone depletion/climate change global warming/climate change health damage nuisance/health damage nuisance/health effects health damage/odour nuisance nuisance/odour health damage/ecological damage/soot deposition health damage/ecological nuisance/ecological damage ecological/health damage
Energy generating equipment turbines boilers/heaters furnaces transport (diesel, gasoline) drilling, etc
CH4 SOx NOx N2O CO2 CO noise light odorous compounds particulates/dust radiation PAH H2S heat PCB Trace toxics (e.g. catalysts, heavy metals, chemicals)
global warming/climate change/atmospheric ozone increase acid deposition, water and soil acidification, global cooling atmospheric ozone increase/acid deposition/fertilisation global warming/stratosphere ozone depletion/climate change global warming/climate change health damage nuisance/health damage/wildlife damage nuisance/health damage/wildlife damage nuisance/odour ecological damage/health damage/soot deposition ecological/health damage ecological/health damage nuisance, health damage, ecological damage health damage, ecological damage health damage, ecological damage health damage, ecological damage global warming/climate change/atmospheric ozone increase atmospheric ozone increase/health damage/ecological damage health damage/ecological damage
Venting tanker loading production pressure relief glycol venting
CH4 VOC/CxHx Specific Chemicals
Refrigeration Fire extinguishers Fugitives valves, pumps, etc
CFC halons CH4 VOC/CxHx/specific chemicals
global warming/climate change/stratosphere ozone depletion global warming/climate change/stratosphere ozone depletion global warming/climate change/atmospheric ozone increase global warming/climate change/atmospheric ozone increase/ health damage/ ecological damage
48

Source* Water water based mud oil based mud aqueous effluents site drains storm water run off produced water cooling water tank bottom water oil ROUTINE HAZARDS POTENTIAL EFFECTS floating layer/unfit for drinking recreation/tainting of fish/biological damage tainting of fish, damage to aquatic organisms, unfit for drinking, recreation, irrigation, livestock. accumulation in biota and sediments, adverse effects on organisms, unfit for drinking, recreation, irrigation, livestock. biological damage smothering/damage to sea bed and biota eutrophication nuisance damage to aquatic organisms
soluble organics/dissolved HC/BTEX heavy metals salts barite (mud), drilling fluids, drilling cuttings nutrients odour chemicals/corrosion inhibitors/biocides/ fungicides volume of water to land fresh water discharge suspended solids soil/ erosion sediments PAH Grease salts/brine acids/caustics temperature change detergents pathogens
Black water and/or grey water (sewage and wash water)
increased water table, flooding, change in riverflow decreased salinity decreased transparency, damage to coral reefs, damage to and bottom organisms, recreation, habitat smothering, damage to vegetation damage to aquatic organisms, water not fit for drinking, irrigation, livestock. water not fit for recreation, damage to bottom sediments increased salinity, damage to aquatic organisms, water unfit for drinking, recreation, irrigation, livestock damage to aquatic organisms change in oxygen concentration, damage to aquatic organisms, increased growth/blooms eutrophication/toxicity health damage
anoxia (deoxygenation) nutrients specific chemicals odorous compounds heavy metals noise/pressure waves paints solvents cleaners Soil oil sludges tank bottom sludges oil based muds water based muds drilled cuttings contaminated soil soil sediments oil/hydrocarbons heavy metals chemicals specific chemicals
Sacrificial anodes Detonators Chemicals
biological damage eutrophication damage to aquatic organisms water unfit for drinking, recreation, irrigation, livestock nuisance odour/smell damage to aquatic organisms, water unfit for drinking, recreation, irrigation, livestock damage to aquatic organisms/repellent biological toxic or chronic damage/global warming health/biological toxic or chronic damage/global warming biological toxic or chronic damage soil contamination; ground water contamination soil contamination soil contaminations; groundwater contamination; smothering. soil contamination; groundwater contamination; smothering.
Eroded Materials
smothering, biological damage
49

Source* Solid/liquid wastes, medical waste, spent catalyst Household, food/kitchen and office waste Landfarming ROUTINE HAZARDS hazardous wastes toxic substances organic and specific wastes pathogens oil/hydrocarbons heavy metals chemical additives soil compaction vibrations presence of workforce with different socio/cultural background during construction and operation; community intrusion land take by: - seismic - drilling - field development, tank forms - access routes - camps, offices, warehouses - pipelines Need for energy energy take Need for water heaters/boilers power generation steam generation vehicles/transport cooling damage to wetlands draw down of ground water level/damage to water well users impact on downstream users cooling process drinking water waste waters irrigation POTENTIAL EFFECTS soil contamination; groundwater contamination; health damage. soil contamination; groundwater contamination damage to health soil contamination; groundwater contamination damage to health changing surface hydrology; changing sub-surface hydrology; reduced plant growth; erosion nuisance/animal repellent socio/cultural effects; employment in-/decrease; influence on local population/demography; demands on local resources/surfaces
Heavy vehicles Vibrating equipment Human resources
Need for land
soil erosion, destruction of habitat changing surface hydrology removal of vegetation change land use, change in natural relief change in accessibility damage to natural habitat
visual impact loss of energy resources
water take
recharge/pressure maintenance Need for gravel/sand gravel/sand take drill pads access roads camp base/levelling facility construction damage to habitat/vegetation/crops visual impact/land scarring change to surface hydrology change in natural relief
recovery and replacement Need for consumables use of non renewable raw materials depletion of raw materials
* any indented (-) are covered by all aspects in the adjacent columns.
50
Appendix III Hazards and Effects Hierarchy This page intentionally left blank
51
APPENDIX IV STRUCTURED REVIEW TECHNIQUES SUMMARY DESCRIPTION SHEETS

Title ASPIN Emergency Systems Survivability Analysis (ESSA) Environmental Assessment (EA) Explosion Protection Review (EPR) Fire and Explosion Analysis (FEA) FIREPRAN HAZID HAZOP Health Risk Assessment (HRA) Job Hazard Analysis Physical Effects Modelling (PEM) Process Hazard Review (PHR) Platform Layout Methodology (PLM) RISER Smoke Ingress Analysis (SIA) SAFOP Structural Consequence Analysis (SCA) Temporary Refuge/Escape Evacuation and Rescue Analysis (TR/EERA) The Health, Environment, Safety Information System (THESIS) Tripod-BETA Tripod-DELTA
Assets* Activities*
Assets*
Activities*
* * * * * * * * * * * * * * * * * *
* * * * * *
* * *
Used primarily in planning, design, longer term review and preparation of HSE Cases for assets. Used primarily for developing and reviewing operational-type procedures, systems and preparing activity HSE Cases, plans or method statements, e.g. seismic drilling, construction and commissioning, and production and maintenance.
52
Appendix IV Structured Review Techniques Summary Description Sheets
ASPIN Objective To provide an easy-to-use quantitative failure risk assessment tool to compare different options and conditions during pipeline design and operation and to assist in optimising and planning inspection and maintenance efforts. It is a tool that is situated between a full Quantitative Risk Assessment (QRA) and simple risk ranking/scoring methods, less complicated and expensive than the former and more quantitative (and therefore more accurate) than the latter. It is intended as a decision support tool and does not specify acceptance criteria for risk levels. It can, for example, identify the effect of use of inspection pigging and a leak detection system on risk levels. Method The methodology is based on the generally applied risk analysis technique whereby the probability of a failure, expressed in terms of expected failure frequency, is multiplied by the consequence of such a failure to arrive at risk. Failure risk is determined cumulatively over a given longer period of time as well as on a yearly basis. The method is structured in four main parts:
1. 2. 3. 4.
Identify the possible failure causes and derive potential failure frequencies Identify the most likely failure type distribution Identify the consequences of pipeline failure Combine parts 1 and 3 to derive risk levels
Information Required (Input)
pipeline fluids (those covered are: crude oil, natural gas, sour natural gas, NGL, fuel gas, gas oil/diesel, kerosene/naphtha/gasoline, LPG, ethylene, propylene and two-phase oil/gas fluids)

impact failure statistics and failure frequencies construction/material defect failure statistics and failure frequencies corrosion statistics or estimated possible mechanisms/expected time to first failure (wall thickness, critical defect depth, inspection surveys, actual corrosion data), annual corrosion failure frequencies
Deliverables (Output) Safety, environmental and economic risk comparison assessments that can be used in support of pipeline design and operation decisions. ASPIN can be used in the development of HSE Cases as part of the HSE MS including input into Hazards and Effects Register. ASPIN identifies and assesses all potential major hazards, evaluates the risks and the effectiveness of the various measures to reduce the risks to the lowest practicable level. Further Information EP 94-0101 - ASPIN Version 1.1 Pipeline Failure Risk Assessment (Ref. 13) EP 94-0102 - ASPIN Version 1.1 Pipeline Failure Risk Assessment (Ref. 14) EP 94-0195 - Simplified Method for Pipeline Risk Ranking, Version 2.0 (Ref. 15) DEP 31.40.60.11 - Gen Pipeline Leak Detection (Ref. 24).
53
Emergency Systems Survivability Analysis (ESSA) Objective Determination of the ability of the emergency systems to withstand severe accident conditions. If performance criteria for essential safety systems are developed as part of the process which evaluates fires and explosions an ESSA as a separate exercise may not be required. Method Identification of all the safety and emergency systems. Assessment of the criticality of each system with respect to preventing escalation, protecting the Temporary Refuge(s) (TR(s)) and enabling escape/evacuation. The critical systems are then assessed to determine their vulnerability to explosions and fires. Information Required Detailed information on the type and layout of safety and emergency systems for example ESD power systems and emergency communications. Fire and explosion scenario data from the Explosion Protection Review (EPR) and Fire and Explosion Analysis (FEA) . Deliverables Identification of critical emergency equipment and system locations. An assessment of the vulnerability of the critical systems during direct and escalated events. Overlap ESSA is a part of the FEA process and provides information which is subsequently used in the Temporary Refuge/Escape, Evacuation and Rescue Analysis (TR/EERA). Further Information Shell Expro document EN/074 (Ref. 11).
54
Environmental Assessment (EA) Objective To predict the significant chemical, biological and socio-economic effects of an activity and to make recommendations on activities, sites, techniques and technologies to be adopted in order to maximise the positive, and minimise the negative effects. Method

Acquisition of environmental description in terms of abiotic, biotic and human environments Identify project environmental hazards and characterise the environment Evaluate the magnitude and significance of environmental effects Determination of any environmental control and recovery management requirements.
Information Required Site and potential waste product descriptions, project description including process materials and sources, materials of construction, project schedule and both strategic and local economic benefits. Deliverables

Environmental Statement Agreed adjustment to design options Mitigation and recovery measures during operations Environmental report covering suggested monitoring programmes and environmental management systems. This report can be used as the basis for public meetings and exhibitions if required.
Overlap Environmental Assessment (EP 95-0370) describes the Hazards and Effects Management Process (HEMP) as it applies to environmental matters throughout the life cycle of a development. Further Information EP HSE Manual, Environmental Assessment, EP 95-0370.
55
Explosion Protection Review (EPR) Objective Determination of worst case scenarios for explosions which then define the limits required for designing offshore installations to withstand accidental vapour cloud explosions. Method Explosion overpressure prediction models are used to determine the worst case peak internal explosion overpressure and an estimate of the overpressure external to the source module. The Thornton model SCOPE is used to determine the worst case peak confined internal overpressure and an estimate of the overpressure external to the source area. This information is then used to assess the capacity of the blast walls, floors, ceilings and other structural components as well as the effects of the external explosion. Information Required Information on the area geometry, equipment layout and structure design. Worst case assumptions are generally made on gas concentrations, gas volumes and ignition source locations. Deliverables Explosion overpressure for each module with the associated effects on the module structure and an indication of the capacity of the module to withstand the explosion. Recommendations to reduce or contain the explosion overpressure. Overlap EPR is effectively a stand alone technique but is part of the Fire and Explosion Analysis (FEA) process. Further Information Shell Expro document EA/083 (Ref. 25).
Fire and Explosion Analysis (FEA) Objective A general term for a process which identifies and evaluates all fire and explosion hazardous events as a basis for risk reduction and for preparing performance criteria for essential safety systems and the arrangements required for Escape, Evacuation and Rescue (EER). Method The location and type of all potential fires (and explosions) are identified. The capability of the existing or required fire protection (and explosion relief) measures are established together with the corresponding performance standards. Estimates of the damage potential of each event are made. The FEA process is a fundamental part of developing an installation Quantitative Risk Assessment (QRA) model and can either be undertaken as part of the QRA or as a stand alone exercise providing input to the QRA. Information Required Detailed information on plant layout, fire areas, hazardous areas, flammable inventories, fire and safety equipment layout, passive fire protection location, fire water piping runs and any other pertinent data. Deliverables All potential fire and explosion events are identified and a number subjected to more detailed evaluation. Requirements for the essential safety systems to manage fire and explosions and for EER are identified. Overlap ESSA, EPR, SIA, SCA, FIREPRAN are all components of the FEA as necessary. The FEA utilises PEM. Further Information There is not a specific guideline on FEA, it is a collective term describing a process, which utilises a number of techniques including PEM.
56
FIREPRAN Objective A structured review technique for the review and assessment of: 1. 2. 3. hydrocarbon release and combustion related risks in a facility the fire and explosion control and recovery preparedness measures in place. the capability to meet the performance standards set and satisfy the objectives and criteria set for the management of fire and explosion hazards.
To identify deficiencies and opportunities for improvement in order to meet objectives with respect to fire and explosion management. FIREPRAN is not suited to complex, compact integrated facilities. Method A multi-disciplined team uses a structured HEMP compatible approach to identify hazards related to hydrocarbon releases and explosions and develops a hazards and effects hierarchy. The hazard control measures and related hazardous events mitigation and recovery measures are recorded in a hazards and effects register. Potential fire and explosion scenarios are developed enabling review of the resources needed to respond effectively to these incidents. Resources needed to respond effectively to fire and explosion hazardous event scenarios are compared with those already in place. Results are presented with opportunities for improved risk reduction measures as appropriate to plant criticality. Information Required

Process flow schemes, plot plans, plant layouts and hazardous area drawings Fire system and fire water piping drawings, fire areas, equipment layout, fire and blast walls and passive fire protection drawings Operating and maintenance philosophies
Deliverables This technique permits the identification of hazards as well as potential, related fire and explosion scenarios. It assists line management in the process of developing realistic, cost effective, control and recovery measures which can be justified in terms of reducing risks to personnel, environment, assets and production, to tolerable levels. Deliverables take the form of a hazards and effects register, fire and explosion scenario development sheets and a set of recommendations for actions needed to achieve tolerable risk levels. Overlap HAZOP, QRA (for complex studies). Further Information EP HSE Manual, FIREPRAN, EP 95-0350.
57
HAZID (Hazard Identification) Objective To identify at an early stage in a green or brownfield project or development plan the major Hazards which must be removed or managed. Method A multi-disciplined team review of the overall project development proposal (including infrastructure) plant design and operation together with its impact on the local environment. The study uses a step-by-step methodology and a checklist of guide words to identify hazards and assess the influence these hazards may have on the project development strategy and design philosophy. The scope will encompass both current and future life cycle issues. Information Required (Input) Information pack on project, its potential scope and environmental issues. All available conceptual and preliminary drawings and development plans. Deliverables (Output) Input of major hazards identified to Hazards and Effects Register together with recommendations in priority order. An initial statement on hazard manageability and assurance needs. Further Information EP HSE Manual, HAZID, EP 95-0312.
HAZOP (Hazard and Operability Study) Objective To identify the Hazards, Effects and Operability problems relating to the process design and intended method of plant operation which must be removed or managed in the operation.

Coarse HAZOP - Early study to identify basic flaws in design which would be costly to correct later. Main HAZOP - Primary vehicle for identification of hazards, effects and operability problems. Held when the front end engineering design is almost complete so that systems can be covered in detail. Final HAZOP - Coverage of those systems not sufficiently developed for consideration in the Main HAZOP, particularly vendor data, and a formal review of action responses to previous HAZOPs. Procedural HAZOP - Identification of hazards and operability problems arising from procedures such as commissioning, maintenance and other non-continuous procedures.
Health and environmental aspects must be included on the same basis as safety. Method A multi-disciplined team review using a structured step-by-step methodology with the application of parameter and guide word combinations to sections (nodes) of the system to identify hazards and operability problems normally with a facility but also with procedures.

Coarse HAZOP - Large nodes concentrating on major issues, requires a team of experienced senior engineers. The recommendations from a Coarse HAZOP may involve significant changes to the design. Main HAZOP - Rigorous application of the technique to relatively small nodes, requires a team of experienced engineers with extensive project experience. Final HAZOP - Rigorous application of the technique to relatively small nodes, requires similar team as for Main HAZOP with the addition of vendor representatives. At this stage recommendations should be concentrated on will it work rather than it would improve the safety of design to have. Procedural HAZOP - Application of specialised guide words to operating procedures, requires a team similar to that for main HAZOP with greater emphasis on operational personnel.
58
Information Required (Input)

Coarse HAZOP - Basic layouts, process flow schemes (PFSs) and any operating/control philosophies that are available. Main HAZOP - Process and Utility Process Engineering Flow Schemes, (PEFSs, UEFSs) Operating and Control Philosophies, Cause and Effect Diagrams, Process Safeguarding Drawings, line lists, alarm and trip settings. Final HAZOP EFSs and Vendor drawings, data, previous HAZOP findings and responses and any design changes since last HAZOP. Procedural HAZOP - As for Main HAZOP and Operating Procedures.
(Continued on next page)
HAZOP (continued) Deliverables (Output)
Coarse HAZOP - Recommendations for adjustment to design options, QRA studies and other supporting investigations. A risk ranking may be given to assist in prioritising the actions. This list may be incorporated into the Hazards and Effects register for the project.
Main HAZOP - Recommendations to amend the design to remove or reduce hazards and operability problems. Categorisation of the recommendations into approximate risk groups to assist in prioritising the actions. This list should be used to update the Hazard register for the project.
Procedural HAZOP - Recommendations to amend the procedures to remove or reduce hazards and operating problems. This will allow Safety Critical Procedures/Operations to be identified.
Overlap HAZOP is a stand alone process hazard and operability problem identification and assessment (qualitative) tool. Further Information EP HSE Manual, HAZOP, EP 95-0313.
59
Health Risk Assessment (HRA) Objective The identification of health hazards in the workplace and subsequent evaluation of risk to health, taking account of existing control measures. Where appropriate, the need for further measures to control exposure is identified. Method HRA consists of a number of steps: Step 1 Step 2 Step 3 Step 4 Step 5 Step 6 Step 7 Define management's role and responsibilities and allocate resources Define structure for implementation (identify assessment units; assessment team; job types; tasks; hazardous agents) For each job type gather information on agents and their harmful effects; nature and degree of exposure; screening and performance criteria Evaluate the risk to health (assign severity rating and exposure rating) Decide on remedial action Record the health risk assessment Review the health risk assessment.
Information Required Detailed information on hazards and effects (e.g. toxic properties of chemicals); exposures (e.g. exposure levels to toxic chemicals); performance of existing controls; information from health surveillance records, etc. Deliverables HRA, as a tool for use as party of a company's HEMP, assists to identify, evaluate and control health risks related to the company's operations to a level 'as low as reasonably practicable'. The recommendations emerging from the HRA provide the input into the HSE Management System to ensure ongoing control of health risks and continual improvement in health performance. Further Information SHSEC Guide (Ref. 2) and references contained within that document.
60
Job Hazard Analysis (JHA) Objective Identification of potential problems within a job task that could lead to hazardous situations. Elimination or reduction of the hazard by development of safe working procedures. Method The method is derived from Task Analysis. It is a structured step-by-step team analysis of the job. Initially the job is broken down into individual steps which are then analysed sequentially to identify potential injuries to personnel, damage to equipment and pollution of the environment. The controls and preventative measures are considered and if found to be inadequate remedial recommendations are made. Consideration is also given to the establishment of recovery measures if necessary. Information Required Job description, plans and drawings. Historical records of accidents and near misses. Team members with technical competence relevant to the job being analysed. Deliverables Step-by-step analysis of each job highlighting potential departures from normal practice, with associated hazards and recommendations for remedial action. The analysis also identifies the accident prevention responsibilities for key personnel. The report can also be used as the basis for the development/ modification of operating/working procedures. Overlap Job Hazard Analysis is a stand alone technique but is often used in configuration with PTW system. Further Information EP HSE Manual, Job Hazard Analysis, EP 95-0311.
61
Physical Effects Modelling (PEM) Objective To model the physical behaviour of the potential release of a hazardous fluid or substance and subsequent related events to determine a measure of the effect, in terms of loading, on people, the environment and assets for each potential outcome. Method The physical effects, such as dispersion, explosion over pressures and heat radiation are calculated as input to assess potential extent of loss of life or damage. Use of step-by-step modelling allows potential escalation scenarios to be assessed. Information Required Detailed information on: physical properties, such as density and toxicity; environmental factors, such as wind velocity, humidity ambient temperature, and geometrical obstructions, confinement, etc. Information on process flows and any mitigating measures, such as inventory ESD or blowdown systems. Access to sophisticated consequence modelling computer programs, e.g. FRED, HG SYSTEMS and SCOPE. Deliverables Data on the potential consequential loadings of previously identified hazardous scenarios with respect to the potential effects to personnel, the environment and the facilities. Overlap Input data for Physical Effects Modelling can be generated from hazard identification techniques contained in FIREPRAN, QRA and HAZOP. Physical effects modelling may be used as an aid to Quantitative Risk Assessment, (QRA), FIREPRAN, PHR, Plant Layout Methodology (PLM) and Fire and Explosion Analysis (FEA). Output from physical effects modelling will provide input to physical response assessment (e.g. SCA) and consequent modelling. Further Information EP HSE Manual, Physical Effects Modelling, EP 95-0314.
62
Process Hazard Review (PHR) Objective An assessment of the safety status of existing process plant. It is intended for use when a plant has been in operation for a considerable time and/or has undergone equipment modifications and operation changes. It is used to provide an HSE Assurance report for ongoing operations in advance of major modifications or for life extension evaluations. Method PHR is an 'expert review' led by an experienced leader, containing design engineers but heavily weighted towards plant operators and maintenance staff. The review primarily focuses on potential causes of 'loss of containment'. The study progresses through the plant looking at each major equipment items, applying a leader's checklist (aide-mmoire) of causes of loss of containment. The current design and operation of the plant is assessed and a critical examination made of the revision history to identify any causes of release resulting from changes to the design and operation of the equipment item since commissioning. The team also reviews any hazards arising from variations (due to the age of the plant) from current design or operating standards. Information Required The technique assumes that most of the drawings are near to current status. The meetings are normally held on the plant with regular site visits to check any details not 'as built' on drawings. The latest version of the Process Engineering Flow Schemes (PEFS) is used as the major study document to ensure complete coverage of the scope of the study. Additional information required includes the cause and effect diagrams and the full revision history and incident reports for the plant together with changes in the operating envelope and operation/maintenance procedures. The expertise of the team is of critical importance. Where data are incomplete the PHR technique is applicable but success relies heavily on the study team containing operating staff with considerable depth of experience and knowledge of the plant throughout its operating life. Deliverables A report showing the identified hazards, their causes and the concern of the team together with recommendations for any remedial action including, if appropriate, more detailed HAZOP in discrete areas. Overlap HAZOP, FIREPRAN, Technical Audit. Further Information SIEP.
63
Platform Layout Methodology (PLM) Objective Provision of an auditable framework within which the essential processes in the development of an offshore platform topsides layout can be structured. Method

Establishment of the functional shape of the facility with due regard to safety and operational constraints A structured approach is used to select layout preferences based on the inherent active and reactive behaviour characteristics of equipment items with due regard for separation distances and physical barriers Consideration of previously identified hazardous scenarios to identify those which are highly likely to reach adjacent areas of the facility.
Information Required Facility layout drawings and any available information from physical effect and consequence modelling. Deliverables A structured auditable description of the development of an offshore platform topsides layout. Overlap Input data from PEM and consequence modelling. Further Information EP 90-2500 (Ref. 9) EP 91-1600 (Ref. 7) EP 91-1601 (Ref. 8). A similar document describing an onshore layout procedure is planned.
64
RISER Objective Assessment of risks of pipeline riser on or near platforms with comparative risk analysis to assess the benefits of subsea valve installation on pipelines. Method The method is based on the following steps (using the information required described below):

definition of release cases using clear selection rules failure frequency estimation (using a standard historical data set modified where needed to allow for local factors) consequence modelling (from release rate calculations using models for dispersion, jet fires, explosions, etc) impact assessment (determination of fatalities/damage and probabilities followed by event tree analysis) risk calculation (determination of total risk for the riser system).
Information Required Platform and pipeline engineering data, personnel numbers and distribution, environmental data and evacuation systems. Deliverables Data on the comparative risk expressed as Potential Loss of Life (PLL) Overlap Input data from hazard identification techniques such as FIREPRAN, Quantitative Risk Assessment (QRA) and Hazard and Operability Studies (HAZOP). Output data are used in Quantitative Risk Assessment (QRA), FIREPRAN, Plant Layout Methodology (PLM) and Fire and Explosion Analysis (FEA). Further Information EP 90-1045 RISER Riser Safety Evaluation Routine (Ref.16).
65
SAFOP (Electrical Safety and Operability Study) Objective Identification of potential hazards to personnel in the vicinity of electrical systems. Critical assessment of electrical network and plant design and analysis of operator actions to determine areas of potential operator error. Making recommendations to eliminate or reduce risks. Method A multi-disciplined team and a structured step by step methodology are used.

SAFAN - Hazards present in construction, commissioning and operation of electrical systems are examined in relation to the safety of personnel in the vicinity. SYSOP - Examination is made of the control systems, the main items of plant and their auxiliaries in relation to any limitations and their effects on the overall system operability. OPTAN - Considers probable tasks to be under taken during normal and upset conditions. The usability of equipment and clarity of instructions are reviewed with the aim of reducing the potential for human error as low as is reasonably practicable.
Information Required Detailed electrical system design and layout drawings, control circuit diagrams, system designs and functional specifications, and electrical system operating and emergency procedures. Deliverables Report detailing the findings of the audit and where necessary making recommendations categorised as Strongly Recommended, Advice or call for further information Information Required. Overlap SAFOP is a stand alone technique but it has some overlap with Job Hazard Analysis EP 95-0311, Human Factors Analysis EP 95-0324 and Procedural HAZOP. Further Information DEP (Ref. 5) under preparation. Until release consult Electrical Engineering. Refer to SIEP.
66
Smoke Ingress Analysis (SIA) Objective Determination of the rate of build-up of gases and smoke in and around designated Temporary Refuges (TRs) and the effect this will have on TR integrity and the ability of occupants to survive. The SIA is an integral part of Escape Evacuation and Rescue Analysis/Temporary Refuge (EERA/TR) but is so significant that it has been documented separately. Method Input on the type size and duration of potential fires is taken from the Fire and Explosion Analysis (FEA). Each scenario will then be analysed to determine the concentration of smoke and gases at the boundary of the TR and subsequently the build-up inside and around the TR. Consideration is given to the dilution and dispersion effects that may occur between the fire source and the TR. Assessment is also made of the leak paths and any localised over or under pressures caused by wind effects in order to determine the rate of ingress to the TR. If available, actual installation test data are used to increase the realism of the SIA. Information Required Installation layout drawings, details of TR construction and the details of the fire scenarios from the FEA . Leak test data for the TR. Deliverables Identification of scenarios that have the potential to effect significantly the TR in terms of smoke or gas ingress at build-up rates which would impair TR integrity or impact on the emergency response capability. Overlap The results from the SIA are be used in TR/EERA analyses. Further Information Shell Expro document EN/066 (Ref. 26).
Note: There are several practical and theoretical problems with the methodology in EN/066. The model is written in Supercalc 5 which is not a Shell-supported package and there may be considerable difficulty in running the software. Expro are planning to revise EN/066 to provide guidance on smoke, heat, CO and low oxygen impairment of the TR. This work is planned to also overcome the technical limitations of the current methodology and to incorporate results of relevant research in these areas.
67
Structural Consequence Analysis (SCA) Objective Assessment of the response of a structure under fire conditions. Determination of the extent of any failure under fire loading and, if necessary, proposal of remedial measures. Method
Coarse analysis is based on determining the time to failure of the structure from linear elastic techniques. This analysis determines those structures which are critical and which should be the subject of more detailed analysis. Detailed analysis is based on non-linear analysis methods. These allow the true collapse load of the structure to be estimated by modelling elastic-plastic behaviour of the structure at elevated temperatures. The USFOS analysis program may be used for these studies.
Information Required Details of potential fires from FEA , data on the type and layout of existing fire protection facilities. Detailed structural drawings. Deliverables Report on the ability of the structure to withstand the fire scenarios identified. This will reveal if there exists the potential exists for fire to lead to progressive collapse of the structure or loss of the TR within the required endurance period. If necessary recommendations for remedial actions and distribution of protective equipment should be made. Overlap Input data is required from Fire and Explosion Analysis (FEA) and physical effects modelling. SCA may be used in QRA. Further Information Expertise and advice should be sought from SIEP Structural engineering function.
68
Temporary Refuge/Escape, Evacuation and Rescue Analysis (TR/EERA) Objective Analysis of escape to TR, the provisions within the TR system, and Evacuation, Escape and Rescue with respect to the major scenarios previously identified for comparison against respective acceptance standards highlighting critical elements and revealing any shortfalls. Method The EERA/TRA comprises three related elements:

a goal analysis which considers how the goals for the EER process will be satisfied in likely EER situations as a basis for determining the adequacy of the proposed arrangements an escape and evacuation time analysis which considers the time needed to complete all phases of the EER process under conditions which may be present when there is a need for EER a TR impairment analysis to determine the frequency that the TR and related evacuation facilities will be impaired.
Information Required Detailed information on the TR/EERA provisions and details of the major hazard scenarios identified. Details of installation layout including muster stations, refuges, evacuation points and escape to sea facilities. Input data from Fire and Explosion Analysis (FEA), Smoke Ingress Analysis (SIA) and Emergency Systems Survivability Analysis (ESSA). Deliverables A formal record of the EER facilities and arrangements with details of the direct and escalated impact of the identified hazard scenarios coupled with considerations on the likelihood of their occurrence. Overlap Input data required from FEA , SIA and ESSA. The results of the TR/EERA may be used in the QRA. Further Information Shell Expro document - EA/032 (Ref. 27) and DEP 37.17.10.11 Gen (Ref. 12).
69
THESIS (The Health, Environment, Safety Information System) Objective To provide a structured method for building, using and maintaining Safety (HSE) Management Systems and Cases. To store Safety (HSE) Management System and Case data in an electronic relational data bank on a computer for easy access and use and generate HSE Cases in a consistent structured manner. Method THESIS provides checklists, models, prompts and facilitates structured brainstorming to identify the hazards and effects and critical activities of an operation. Once the hazards and effects and activities are identified a process is provided to document and qualitatively assess the controls in place and identify shortfalls. It uses workforce experience and engineering judgement to identify and qualitatively assess the HSE management system in use. The build process is designed to provoke and facilitate discussion concerning the degree of existing hazard control provided and how adequately HSE critical activities are performed. Information Required Personnel with detailed working knowledge of the operation or installation for which the Case is being prepared. Operational information about the operation or installation such as operating manuals, inspection and maintenance manuals, equipment standards and specifications, environmental and health standards, specifications and monitoring data. Deliverables Safety or HSE Case data stored on a computer in a relational data bank for easy access and use. Printed reports are generated which provide a fully documented record of the build and assessment process carried out including the 7 part Safety (HSE) Case document, Hazard Registers, HSE MS Specification Sheets, a list of shortfalls and many more. Once completed, HSE specialists, managers, supervisors and operators have the information needed at their fingertips to implement their HSE management system. They can use THESIS to assess the HSE implications of proposed actions and changes. Overlap THESIS is a stand alone tool. It is designed to be complementary with other management systems such as a maintenance management system. Further Information EP HSE Manual, THESIS, EP 95-0323.
70
Tripod-BETA Objective To facilitate accident or incident investigation and analysis by providing the means to assemble and manipulate investigation information into a logical structure consistent with the Tripod accident causation model and the hazards and effects model of SMS (HSE MS). Method A PC tool which provides the means to record information from the investigation, linking related information on events, people, damage, locations, etc. Information is transferred to a screen where it can be manipulated and linked as nodes in a BETA tree. Nodes are classified, the connecting logic tested and anomalies flagged for amendment. Nodes are assigned General Failure Type (GFT) classifications. Information Required Accident or incident investigation data. Deliverables

A draft report for final editing, presenting salient details of the events, actual and potential damage, failures and identified causes A BETA tree diagram GFT profile for the accident/incident.
Overlap Tripod-BETA is a stand-alone technique. Further Information EP HSE Manual, Tripod-BETA, EP 95-0321
Tripod-DELTA Objective The proactive identification of potential latent failures that could lead to hazardous situations and the development of remedial actions to be taken to reduce or eliminate such hazards. Used where there are few incidents providing information on causation therefore tries to avoid 'requiring incidents to improve'. Method

Development of indicator question database. These are used in the form of yes/no answer questions to reveal the presence of General Failure Types (GFT) in the operation or organisation Tripod-DELTA Profiling-derivation of checklists based on the indicator questions, answering of indicator questions, analysis of answers. Results are presented as a Failure State Profile. The analysis identifies those areas where remedial action is required.
Information Required Access to personnel with detailed working knowledge of the operation or organisation being analysed. Deliverables The Failure State Profile indicates the extent to which each of the 11 GFTs is present in the system under study. This allows remedial actions to be prioritised. Overlap Tripod-DELTA is a stand alone technique. Further Information EP HSE Manual, Tripod-DELTA, EP 95-0320
71
72
Appendix IV Structured Review Techniques Summary Description Sheets This page intentionally left blank
73
APPENDIX V EXAMPLE OF FURTHER DEFINITION OF CONSEQUENCE SEVERITY RATING FOR RISK MATRIX
Table V.1
Severit y Potential Impact No injury Slight injury Injury Definition No injury or damage to health Not detrimental to individual employability or to the performance of present work
Example of further definition of consequence - severity rating for risk matrix

People Health Definition No injury or damage to health Not affecting work performance or causing disability. -Agents which are not hazardous to health Affecting work performance, such as restriction to activities (Restricted Work Case) or a need to take a few calendar days to recover fully -Agents which have limited health effects which are reversible, e.g. irritants, many food poisoning bacteria Resulting in permanent partial disability or affecting work performance in the longer term, such as a prolonged absence from work -Agents which are capable of irreversible damage without serious disability, e.g. noise, poorly designed manual handling tasks - Agents which are capable of irreversible damage with serious disability or death, e.g. corrosives, known human carcinogens Assets*, Equipment
0 1
Potential Impact No injury Slight injury
Potential Impact No damage Slight damage
Definition No damage to equipment No disruption to the process, minimum cost of repair (below $10,000) Possible brief disruption of the process; isolation of equipment for repair (estimated cost below $100,000) Plant partly down; process can (possibly) be restarted. (estimated cost of repair below $1,000,000)
Minor injury
Detrimental to the performance of present work, such as curtailment of activities or some calendar days to recover fully, maximum one week
Minor injury/ illness
Minor damage
Major injury
Leading to permanent partial disablement or unfitness for work or detrimental to performance of work over extended period, such as long term absence
Major injury/ illness
Localised damage
Partial loss of plant; plant shut down (for at most two weeks and/or estimated repair costs below $10,000,000) 5 Multiple May include four fatalities in Multiple -Agents with potential to cause Extensive Total loss of the fatalities close succession due to the fatalities multiple fatalities, e.g. chemicals damage plant; extensive incident, or multiple fatalities with acute toxic effects (e.g. damage (four or more) each at different hydrogen sulphide, carbon (estimated cost points and/or with different monoxide), known human of repair activities carcinogens exceeds $10,000,000) * Assets are understood as referring to: the oil and gas reservoirs, production facilities, pipelines, money, capital, and other Opco and third party property
Single fatality
Alternatively victim with permanent total disablement or unfitness for work. Also includes the possibility of multiple fatalities (maximum 3) in close succession due to the incident, e.g. explosion
Permanent total disability or fatality (small exposed population)
Major damage
74
Appendix V Example of Further Definition of Consequence
Table V.1
Severity
Example of further definition of consequence - severity rating for risk matrix (continued)
Environment Potential Impact Definition Oil Contamination per incident (litres) Sensitive areas Offshore Potential Impact Reputation Definition
0 1
No effect Slight effect
No environmental risk, no financial consequences Negligible financial consequences, local environmental risk within the fence and within systems Contamination, damage sufficiently large to affect the environment, single exceedance of statutory or prescribed criteria, single complaint, no permanent effect on the environment Limited loss of discharges of known toxicity, repeated exceedance of statutory or prescribed limit and beyond fence/neighbourhood
Several <10 0-100
No impact Slight impact
No public awareness Public awareness of the incident* may exist; there is no public concern Some local public concern; some complaints received; slight local media and/or local political attention with potentially negative aspects for Opco operations Regional public concern; numerous complaints; extensive negative attention in local media; slight national media and/or local/regional political attention with possible negative stance of local government and/or action groups National public concern; continuing complaints; extensive negative attention in national media and/or regional/national politics with potentially restrictive measures and/or impact on grant of licences; mobilisation of action groups International public attention; extensive negative attention in international media and national/international politics; potential to harm access to new areas, grants of licences and/or tax legislation; concerted pressure by action groups; adverse effects in Opcos in other countries
Minor effect
<100
100 1,000
Limited impact
Localised effect
100 1,000
1,00010,000
Considerable impact
Major effect
Severe environmental damage, the Opco is required to take extensive measures to restore the contaminated environment to its original state. Extended exceedance of statutory or prescribed limit
1000 10,000
10,000 100,000
National impact
Massive effect
Persistent severe environmental damage or severe nuisance extending over a large area. In terms of commercial or recreational use or nature conservancy, a major economic loss for the Opco. Constant high exceedance of statutory or prescribed limit
>10,000
>100,000
International impact
The above table is an example for crude oil contamination. For other chemical discharge criteria, environmental experts should be consulted. Incidents relating to air, noise, small, light and soil vibrations should be addressed on the basis of expert judgement and, in the case of uncertainty, local expertise may be called in. * 'Incident' as used in Severity level 1 must be seen as the source of the concern for all severity levels. It is defined in the glossary but recognise it includes an environmental problem, an event or chain of events which has caused or could have caused spills, leaks, complaints, public concern, issue debates, failing to follow commitments and so forth. 'Public' must be seen as encompassing a wide range including 'opinion formers', e.g. environmental scientists; groups; politicians; authorities (of various types); media (scientific general).
75
APPENDIX VI WHEN TO USE QRA

Quantified Risk Assessment (QRA) is used to:
assist in reducing risks This is done by identifying areas of high risk or identifying areas where risk can be further reduced. assist in option selection by ranking options in terms of risk assess the cost-effectiveness of risk-reducing measures assist in the demonstration and achievement of ALARP act as an aid to communication with the workforce and third parties regarding their impact on risk and their exposure to risk indicate whether or not risks are tolerable comply with legislation and company policy.
Guidance is given below which addresses the cases when QRA is likely to be of benefit and when it is not. Each individual case should be treated on its merits. Further advice is given in EP 95-0352.
VI.1
VI.1.1
Projects for Which QRA is Likely to be Beneficial

Project identification phase - comparative coarse QRA
All projects onshore or offshore for which several options have been identified which are considered to have significantly different risks. A risk assessment should be undertaken early in a project development (in some cases this may be during the prospect stage, if for instance, novel technology is used). A comparison of risks associated with, for example, onshore versus offshore processing, manned versus unmanned facilities, platform versus subsea installation, location and operating strategy of onshore installations, etc may be effectively studied using QRA.
VI.1.2
Definition phase - project specification - detailed QRA
During the definition phase, a more detailed risk assessment may be required to: (i) assist with final major decision-making with respect to design options
(ii) provide a basis for further design optimisation during completion of conceptual engineering and detailed engineering and (ultimately) to reach risk levels regarded as As Low As Reasonably Practicable (ALARP) (iii) confirm to senior management, shareholders and the Regulator that risk criteria will be achieved. At the end of detailed engineering, i.e. when all optimisation has been completed, the risk assessment is issued in the form of a final report for input to the HSE Case. This is intended to demonstrate that the risk criteria have been achieved and this risk is as low as reasonably practicable. The above is particularly applicable to:
all offshore permanently manned installations
76
Appendix VI When to use QRA This is the case unless the layout is so well spaced-out that the workforce is for the majority of the time outside the maximum effect area of the high pressure hydrocarbon production/process facilities and the risk of escalation is considered to be negligible. onshore plants This is where the public is within the maximum effect radius and/or where the plant is complex and the hydrocarbon processing equipment cannot be spaced to minimise the risk of escalation. studies to compare transport and manning philosophy options If the option under development has significantly different operating philosophies to those considered during the comparative QRA in the project identification phase.
VI.1.3
Operations Phase
Existing facilities Any facility or operation which is considered to be safety critical and for which there are doubts as to whether or not the risks have been reduced to as low as reasonably practicable. A QRA study would assist in the identification of high-risk areas and the ranking of risk reduction measures, identify the need for modifying the operating philosophy (e.g. MOPO), and increase the awareness of the workforce of the risks they are exposed to and have influence over. Upgrades to existing facilities Plant modifications which will result in significant risks during construction and/ or which are expected to increase significantly the risk level during operations. The need for an additional or revalidated risk assessment at the time of proposed upgrades or refurbishments has to be considered. In cases where the proposals are viewed as having a minimal impact on safety or asset integrity, no additional work will be necessary. However, for some modifications the earlier risk assessment will require reviewing and additional risk assessment may be required.
VI.2
Projects for Which QRA is not Likely to be Beneficial
QRA would not usually be used for Not Normally Manned offshore installations and onshore facilities, except in connection with the determination of the operating philosophy unless: the equipment spacing allows escalation the facility has a high strategic or asset value there are environmental concerns the public is in permanently occupied areas within the maximum effect radius it is a legal requirement several expensive risk reduction measures have been identified whose relative effectiveness is not obvious. In other cases, physical effects modelling combined with other non-quantitative methodologies may be sufficient to manage the hazards.
77
GLOSSARY
The general glossary for the EP HSE Manual is now in a separate Section EP95-0010 Glossary.
78
Glossary This page intentionally left blank
79
References
REFERENCES
1 MF 92-0130 Issue 4, Technical HSE Reviews and Fire Safety Reviews: Checklists Planning and Execution, Shell Manufacturing Division, March 1995. Health Risk Assessment, SHSEC, September 1994. ISBN 0 11 430020, Understanding Stress - Part Two Line Managers' Guide, HMSO, June 1992. Chemical Hazards: Health Risk Assessment and Exposure Evaluation, SHSEC, 1995. SAFOP DEP (under preparation). EP 92-1020, Guidelines for Risk Assessment Data Sheets, SIPM, 1992. EP 91-1600, Layout Considerations for Offshore Topsides Facilities, Volume II, Step by Step Procedure and Template, SIPM, 1991. EP 91-1601, Layout Considerations for Offshore Topsides Facilities, Volume III, 'Ariadne' Demonstrator, SIPM, 1991. EP 90-2500, Technology Development, Layout Considerations for Offshore Topside Facilities, SIPM,1990.
2 3
4 5 6 7
10 DEP to be prepared, Onshore Layout Methodology. 11 EN/074, Hazard Identification and Assessment, Shell Expro. 12 DEP 37.17.10.11 - Gen, Design of Offshore Temporary Refuges, 13 EP 94-0101, ASPIN Version 1.1 Pipeline Failure Risk Assessment, User Manual, Worked examples, December 1993. 14 EP 94-0102, ASPIN Version 1.1 Pipeline Failure Risk Assessment, Reference Manual, December 1993. 15 EP 94-0195, Simplified Method for Pipeline Risk Ranking, Version 2.0, January 1994. 16 EP 90-1045, RISER: Riser Safety Evaluation Routine, SIPM, April 1990. 17 Ionising Radiation Safety Guide, SSHC, November 1993. 18 DEP 00.00.05.05-Gen, Index DEP Publications and Standard Specifications, SIPM. 19 Medical Emergency Guidelines for Management, SHSEC, November 1994. 20 HSE 94023, Medical Emergency Guidelines for Health Care Professionals and First Aiders, January 1995 21 HSE 94023a, Guidance to First Aiders, January 1995. 22 Standards for Clinical Services, E&P Forum.
81
HSE Manual EP 95-0300 Overview Hazards and Effects Management Process 23 EP 95-7000 EP Business Model (Version 3.0) Flowcharts and Description of Process Activities, SIEP, 1995. 24 DEP 31.40.60.11 - Gen, Pipeline Leak Detection, September 1994. 25 EA/083, Explosion Protection of Offshore Installations, Shell Expro. 26 EN/066, Methodology of Assessing Smoke/Gas Ingress to Offshore Modules, Shell Expro. 27 EA/032, Escape, Refuge, Evacuation and Rescue - Offshore Installations, Shell Expro. 28 HSE MS, E&P Forum, 1994. 29 EP 92-0945, Business Process Management Guideline, SIPM EPO/72, June 1992. 30 ISBN 0 11 8859889 Successful Health and Safety Management UK Health and Safety Executive, HMSO, 1991. 31 ISO/CD 14.690, Health, Safety and Environmental Management System (Draft). 32 Incident Investigation and Analysis Guide (Revision of Accident Investigation), SHSEC, August 1993.
82

Ep 95 0300 - (Hemp)

Hochgeladen von

Dokumentinformationen

Originaltitel

Copyright

Verfügbare Formate

Dieses Dokument teilen

Dokument teilen oder einbetten

Freigabeoptionen

Stufen Sie dieses Dokument als nützlich ein?

Sind diese Inhalte unangemessen?

Copyright:

Verfügbare Formate

Ep 95 0300 - (Hemp)

Hochgeladen von

Copyright:

Verfügbare Formate

Shell International Exploration & Production B.V.

Overview Hazards and Effects Management Process

Revision 0: 16 October 1995

EP HSE Manual Amendment Record Sheet

EP 95-0300 Overview Hazards and Effects Management Process

Structured Review Techniques

Hazards and Effects Terminology

4.2.3 4.2.4 4.2.5 4.2.6

Record Hazards and Effects

Hazards and effects register 26 Manual of Permitted Operations (MOPO) 27

Hazards and Effects Management Process (HEMP) 11

Assets: planning and review 12 Activities: planning and review 13

Control of release of hazards and effects 27 Recovery preparedness measures 28

Approaches to the Hazards and Effects Management Process

EP 95-0300 Revision 0: 16 October 1995

HSE Manual EP 95-0300 Overview Hazards and Effects Management Process

Appendix III Hazards and Effects Hierarchy

EP 95-0300 Revision 0: 16 October 1995

Elements of the HSE Management System

EP 95-0300 Revision 0: 16 October 1995

HSE Manual EP 95-0300 Overview Hazards and Effects Management Process

Tools for the Hazards and Effects Management Process

Application and competence

EP 95-0300 Revision 0: 16 October 1995

2 Hazards and Effects Terminology

HAZARDS AND EFFECTS TERMINOLOGY

Hazards, Effects and Incidents

EP 95-0300 Revision 0: 16 October 1995

HSE Manual EP 95-0300 Overview Hazards and Effects Management Process

Threats and Barriers

Consequences, Mitigation and Recovery Preparedness Measures

EP 95-0300 Revision 0: 16 October 1995

2 Hazards and Effects Terminology

Rupture and Leak

Plant Detection Separation and Deluge

Recovery Preparedness Measures and Mitigation Measures

EP 95-0300 Revision 0: 16 October 1995

HSE Manual EP 95-0300 Overview Hazards and Effects Management Process

Hazard : Effluent Examples: Input Changes Maloperation Malfunction Treatment system

Discharge ppm Limit Exceeded !

Hazardous Event Pollution

First Hazardous Event or Top Event

Recovery Preparedness Measures and Mitigation Measures

EP 95-0300 Revision 0: 16 October 1995

2 Hazards and Effects Terminology

Hazard: Toxic vapour Examples: Corrosion Maloperation Leaking flanges

Increased risk : Leukaemia Liabilities Loss of reputation

Handling of toxic chemical

Exposure to benzene exceeding OEL* !

Increased risk of leukaemia

First Hazardous Event or Top Event

* OEL Occupational Exposure Limit

Recovery Preparedness Measures and Mitigation Measures

EP 95-0300 Revision 0: 16 October 1995

HSE Manual EP 95-0300 Overview Hazards and Effects Management Process

EP 95-0300 Revision 0: 16 October 1995

2 Hazards and Effects Terminology

Fault and Event Trees

Likelihood and Consequence (or Effect)

EP 95-0300 Revision 0: 16 October 1995

EP 95-0300 Revision 0: 16 October 1995

3 Hazards and Effects Management Process (HEMP)

HAZARDS AND EFFECTS MANAGEMENT PROCESS (HEMP)