Bptt Cow Issow Handbook

bp Trinidad & Tobago CoW / ISSoW Handbook

bp Trinidad & Tobago CoW/ISSoW Handbook

Title of Document: bpTT CoW / ISSoW Handbook Custodian: Operations Technical Authority Status: Managed Last Rev.Date: 03/10/2006 CD#: CoW 4109 Page 1 of 50

1.0 Stopping all Unsafe Work ....................................................................4 2.0 Purpose..................................................................................................4 3.0 Objectives..............................................................................................5 4.0 Work Control Accountabilities ............................................................7

4.1 Site Controller (SC) ......................................................................................... 7 4.2 Area Authority (AA) ......................................................................................... 7 4.3 Affected Area Authority (AAA)......................................................................... 8 4.4 Isolating Authority Process (IAP) .................................................................... 8 4.5 Isolating Authority Electrical (IAE)................................................................... 8 4.6 Isolating Authority Control (IAC)...................................................................... 9 4.7 Performing Authority (PA) ............................................................................... 9 4.8 Technical Authority (TA)................................................................................ 10 4.13 Authorised Gas Tester .................................................................................. 11 4.14 Work Party Members..................................................................................... 11 4.15 Installation Administrator ............................................................................... 11 4.16 Node Administrator........................................................................................ 11 4.17 Guest Role .................................................................................................... 12

5.0 Handover of Responsibilities ............................................................12 5.1 Shift Change..................................................................................................12 5.2 Crew Change ................................................................................................ 12

5.2.1 Performing Authority............................................................................................. 12 5.2.2 Area Authority....................................................................................................... 12 5.2.3 Site Controller / Site Manager .............................................................................. 13

6.0 ISSoW Process....................................................................................14 6.1 WCC Permits.............................................................................................. 14

6.1.1 Hot Work WCC.................................................................................................. 14 6.1.2 Cold Work WCC................................................................................................ 15 6.1.3 Cold Work Breaking Containment - WCC ............................................................ 16

6.2 Confined Space Entry (CSE) WCC............................................................ 16 6.3 WCC Routines............................................................................................... 17 6.4 Work that does not require WCC Authorisation ............................................ 17 6.5 Lifecycle of Work Control Certificates ........................................................... 18 7.1 Documentation of Isolations.......................................................................... 19 7.2 Electrical Isolations........................................................................................ 19 7.3 Process Isolations ......................................................................................... 19 7.4 Personal Isolations ........................................................................................ 19 7.5 Lifecycle of an ICC ........................................................................................ 19 7.6 Sanction to Test (STT) .................................................................................. 20 7.7 Long Term Isolations (LTI) ............................................................................ 20 7.8 Boundary Isolations....................................................................................... 20

8.0 Supporting Processes........................................................................21 8.1 Paper Based Back up system ....................................................................... 21 8.2 Additional Paper Certification........................................................................ 21 8.3 Operations within the 500m Zone .................................................................21

9.0 Risk Assessment Process .................................................................23 9.1 Glossary of Terms ......................................................................................... 23 9.2 Risk Assessment Process............................................................................. 23

9.2.1 Level 1 (L1RA) ..................................................................................................... 24 9.2.2 Level 2 (L2RA) ..................................................................................................... 24

9.3 Other Types of Risk Assessment Conducted in ISSoW ............................... 24 9.3.1 Standalone Risk Assessment (SARA) - WCC...................................................... 25 9.3.2 Operational Risk Assessment (ORA) - WCC ....................................................... 25

9.4 Planning ........................................................................................................ 25



9.4.1 Collating Information ............................................................................................ 25 9.4.2 The Risk Assessment Team (Level 2 RA) ........................................................... 25 9.4.3 Level 2 Risk Assessment ..................................................................................... 25 9.4.4 Work Co-ordination .............................................................................................. 26

9.5 Risk Assessment Matrix................................................................................ 26 10.0 Control of Work Standard ..................................................................34 11.0 Golden Rules of Safety.......................................................................35 12.0 Site Standards.....................................................................................39

12.1 Beachfield Site Standards............................................................................. 39 12.2 Galeota Terminal Site Standards ..................................................................42 12.3 Offshore Site Standards ................................................................................ 45

13.0 HSSE Policy Statement ......................................................................48 14.0 Supplementary Certificates ...............................................................49



LIST OF ABBREVIATIONS

AA Area Authority AAA Affected Area Authority AGT Authorised Gas Tester ALARP As Low as Reasonably Practicable AM Asset Manager COSHH Control of Substances Hazardous to Health CSE Confined Space Entry ELV Extra Low Voltage HV High Voltage IAC Isolating Authority Control IAE Isolating Authority Electrical IAP Isolating Authority Process ICC Isolation Confirmation Certificate Inst Admin Installation Administrator CoW/ISSoW Control of Work/Integrated Safe System of Work L1RA Level One Risk Assessment L2RA Level Two Risk Assessment LSA Low Specific Activity LTI Long Term Isolation Node Admin Node Administrator NORM Naturally Occurring Radioactive Material LV Low Voltage ORA Operational Risk Assessment PA Performing Authority PTW Permit to Work RPE Responsible Person Electrical SARA Stand Alone Risk Assessment SC Site Controller SCC Supplementary Control Certificate STT Sanction to Test TBT Toolbox Talk TA Technical Authority WCC Work Control Certificate



1.0 Stopping all Unsafe Work Intent To stop the continuation of potentially unsafe work at the earliest stage

possible by making every member of the workforce responsible for its prevention.

Mandatory Requirement a) All personnel must be made aware of their obligation to stop work that

they consider to be unsafe.

Requirements: The CoW process must make it unambiguously clear that all personnel are

obliged and have the authority to stop work that they consider to be unsafe. All personnel must be made aware of the actions they must take, including

reporting, when stopping unsafe work. Mandatory Requirement b) All indications from personnel that the work is unsafe must be

properly investigated.

Requirements: In order to comply with this Mandatory Requirement: All instances of work being stopped for reasons of safety must be

recorded. All reports of unsafe work, from any member of the work force, must be

properly investigated and the results recorded.

2.0 Purpose This document describes the bp Trinidad & Tobago Control of Work / Integrated Safe System of Work (CoW/ISSoW) process, the responsibilities of the people involved in the authorisation, preparation and execution of work and the process of task risk assessment that underpins CoW/ISSoW. This process is implemented through a software system that is an integrated electronic work control system covering the areas of work control, task risk assessment and isolations management. Notes:

The use of the software system is described in the electronic Resource Centre that is an integral part of the software. All task risk assessments shall be carried out in accordance with the standards set out in bpTT Policy and Guidance on Management of Risk STP-IM-009 All associated Process Isolation activities shall be carried out in accordance with the bpTT SIRPS Manual TRD 2143 All associated Electrical Isolation activities shall be carried out in accordance with the bpTT Energy Isolation Electrical Standard TRD 2163



3.0 Objectives The prime objective of CoW/ISSoW is to ensure that work is properly controlled, co-ordinated and communicated. It is the means of providing written instructions and authorisation to people carrying out potentially hazardous work. The system allows individuals, with individual passwords, certain privileges to perform certain tasks designated to their responsibilities. This forms part of the training process with privileges being entered into the CoW/ISSoW system once confirmation of training level has been established. This is performed by the site focal point. The CoW/ISSoW process provides the following key elements: Authorisation Approval, both before work starts, and at change of shift, to confirm the worksite remains safe. Co-ordination Area Authority on an asset to ensure that tasks that may clash with each other are not authorised to be carried out at the same time. Communication Through face to face contact at permit issue to ensure that all personnel who need to know that the task is being carried out are made aware of it. Planning Ensuring that the tasks to be done are fully considered, the sequence of working decided and all personnel and equipment prepared for the tasks. Note: A daily planning meeting must be held. Discipline The system can only operate effectively if all personnel associated with a task, understand and comply with the WCC requirements and the CoW/ISSoW rules and procedures. Toolbox Talk A comprehensive worksite briefing carried out by the Performing Authority where the Risk Assessment, WCC precautions and conditions associated with carrying out the work are communicated to the work party. Supervision An appointed Performing Authority, responsible for ensuring compliance with all requirements specified on the WCC. Task Risk Assessment To ensure that the nature, content and location of a task are clearly defined, hazards are identified and controls defined to reduce the risks to as low as reasonably practicable (tick box



stating ALARP). Task Risk Assessment is a key element of the Work Control Certificate in that it records and communicates all identified hazards and controls necessary to ensure the safety of personnel, however it relies on everyone involved to make it work. Recording Lessons Learned Information about what has been learned whilst performing a task is recorded in order that others can benefit from earlier experiences.



4.0 Work Control Accountabilities The key accountabilities within the CoW/ISSoW are described in this section. No one may be assigned a role within CoW/ISSoW unless they have successfully completed the appropriate training and been formally appointed. There are two types of roles within CoW/ISSoW:

Persons who sign Certificates as gate keepers, e.g. Site Controller / Area Authority / Performing Authority. CoW/ISSoW will check that a person with the correct electronic authorisation role has carried out the necessary actions.

Persons who counter-sign Certificates are defined in the bpTT business process as being required to carry out particular checks or actions, but CoW/ISSoW does not check that these actions have been carried out.

4.1 Site Controller (SC)

This will normally be the Offshore Installation Manager or Onshore Site Manager.

The principle accountabilities of the SC are:

The SC/OSM is the Single Point of Accountability for CoW/ISSoW on his or her facility / site.

Control and coordinate all work on the site or within the sites zone of authority

Ensuring persons appointed to roles within CoW/ISSoW have undergone the required training and are assessed competent for those positions and these details are recorded.

As a Gate Keeper, authorisation of all categories of WCC.

Ensuring that the requirements for an audit of CoW/ISSoW are complied with and that corrective actions resulting from audit findings are carried out.

Sets expectations for all personnel via issuing of the site standards

Approval of all risk assessments

STOPPING ALL UNSAFE WORK

4.2 Area Authority (AA)

The Area Authority (AA) is the central figure in the day-to-day management of the CoW/ISSoW within their area of responsibility. Depending upon the size of the installation there may be more than one AA. The principle accountabilities of the Area Authority are:

Responsible to the SC/OSM for the safe control of work activities within their area of accountability in accordance with these procedures.

Conducting a site visit with the PA for each task.

Liaising closely with the Performing Authority (PA) when planning WCCs to ensure the appropriate Level 1 or 2 Risk Assessment has been carried out for the task.

Liaising with PA to ensure scope of work is fully understood and that work part is briefed.

Determining the ability of the PA to supervise more than one job.

Ensuring appropriate control measures have been put in place.

Verification of all WCCs in their area of accountability.



Verification of Isolation design for work on allocated system and equipment and control of isolation implementation and removal.

Prior to issuing a WCC, ensuring that all appropriate control measures have been put in place. Furthermore, confirming that the PA fully understands the scope of the task and the other members of the work party have been fully briefed, via the Toolbox Talk.

Manage the paper based back-up system in the unlikely event of a system failure.

Ensuring suitable handovers are carried out at shift/crew change.


4.3 Affected Area Authority (AAA)

This applies where there is more than one AA on a site. Where activities carried out in one area impact or impinge on activities in another area, then the AA must inform the Affected AA. The Affected AA must:

Countersign the WCC from the adjoining area to confirm that he is aware of the activity taking place and that the hazards can be effectively managed with the specified controls.

Communicate with personnel working within his area who may be affected by the adjacent activity to ensure that they understand the potential impact on their activities.


4.4 Isolating Authority Process (IAP)

Only persons assessed as competent isolators and who have completed the appropriate ISSoW training may be assigned to the role of Isolating Authority Process (IAP) in CoW/ISSoW.

The principle accountabilities of the IAP are:

Ensuring isolations are adequately identified, applied, tested and secured, and that Isolation Standards are compliant with to bpTT SIRPS Manual TRD 2143

Demonstrating integrity of isolation to PA

Periodic monitoring of all isolations whilst in force

On approval from the AA de-isolates and reinstates the plant consistent with SIRP standards

Supervising others who may assist in applying/removing the isolation

Communicating effectively with other work parties involved in the work when requested.


4.5 Isolating Authority Electrical (IAE)

The Isolating Authority Electrical is responsible for design of an electrical isolation when requested by the Area Authority. He/she is then responsible for safely isolating a specific section of plant or items of equipment to the highest quality and security of isolation, which is reasonably practicable. The IAE is also responsible for demonstrating the integrity of the isolation to the Performing Authority. The IAE will be authorised to the maximum voltage level required for the isolation.

The principle responsibilities of the Isolating Authority Electrical are:

Participation in Risk Assessments for work with an electrical content and perform all electrical work and testing on electrical equipment in accordance with the bpTT Energy



Isolation Electrical Standard TRD 2163. Identify effective electrical isolations and de-isolations as required on all electrical equipment


Periodic monitoring of all electrical isolations whilst in force

On approval from the AA de-isolates and reinstates the equipment consistent with bpTT Energy Isolation Electrical Standard TRD 2163.


Countersigning all Isolation Confirmation Certificates with an electrical content is mandatory.


4.6 Isolating Authority Control (IAC)

Instrument personnel who have been formally assessed by the site RPE and authorized by the Site Controller/Site Manager to switch, isolate and test control, instrument and telecom equipment with voltage levels less than 50V, can act as an isolating authority under CoW/ISSoW for control, instrument and telecom systems with voltage levels less than 50V phase to earth.

Participation in Risk Assessments for work with instrument content.

Identify effective control isolations and de-isolations as required on all instrumentation equipment


Periodic monitoring of all control isolations whilst in force

On approval from the AA de-isolates and reinstates the equipment consistent with bpTT Energy Isolation Electrical Standard TRD 2163.


Countersigning all Isolation Confirmation Certificates with instrument content is mandatory.


4.7 Performing Authority (PA)

The Performing Authority (PA) is the responsible person for the activity being carried out under the WCC. The PA may be the person carrying out the task or supervising a group of people carrying out a task. The PA can be responsible for more than one task at any one time, providing the tasks can be safely managed concurrently.

The principle accountabilities of the Performing Authorities are:

Create the WCC for the task being planned and take an active role as a team member in the Level 1 and 2 Risk Assessment Process.

Ensuring the worksite is ready for work to commence, and confirming controls in place prior to a WCC being issued by the AA.

Ensuring competent people are in place to carry out the task.

Lead the Toolbox Talk and ensures it is completed and that all members of the work party fully understand the scope of work and agree with the hazards and controls identified for the task by signing the declaration.

Requesting demonstration of Isolation Integrity.



Accepting the WCC from the AA.

Ensures that only the work covered within the scope of the WCC takes place.

Ensures that the worksite is kept in a safe and tidy condition, both during and upon completion of the task

Ensures that a detailed handover is carried out with oncoming PA at shift/crew change.


4.8 Technical Authority (TA)

The Operations Technical Authority is not authorised to sanction Hot Work Naked Flame on a live Production site or facility.

The purpose of submitting a risk assessment to this person is to enable advice and guidance on the integrity of the risk assessment process to be given to the accountable Asset Manager and to provide assurance to the Performance Unit Leader that HOT Work Naked Flame instances remain controlled occurrences.

STOP ALL UNSAFE WORK

4.9 Asset Manager (AM)

The Asset Manager prior to work being undertaken must sanction any Hot Work Naked Flame on a live Production site or installation, including activities within the five hundred (500) metre exclusion zones.

Prior to the Asset Manager sanctioning Hot Work Naked Flame on a live Production site or

facility, the On-Site Manager is required to submit a written risk assessment to both the Asset Manager and the Operations Technical Authority for review.

STOP ALL UNSAFE WORK 4.10 Responsible Person Electrical (RPE) This is a role under CoW/ISSoW to clearly identify which authorised person has the responsibility for the electrical system; the RPE is nominated by the Site Controller/Site Manager from those persons having the highest level of authorisation required for that site. The RPE is not a Gate Keeper in CoW/ISSoW, but countersigns the WCC for the purpose of ensuring electrical safety where there is work with an electrical content, or work carried out in the immediate vicinity of electrical switchgear. The RPE will:

Approve any switching programs Countersign permits with electrical content where the Area Authority isnt electrically

competent, ensuring that the isolation has been correctly designed and the Isolating Authority Electrical has the appropriate authorisation level for the work

Assess and recommend site personnel for authorization to IAE and IAC

STOP ALL UNSAFE WORK At any one time there can be only one RPE on site. The RPE may also be the isolating authority electrical. 4.11 Department Head (DH)



The Department Head role does not exist on all sites, but where applicable the principal accountabilities of the DH are:

Responsible and accountable to the Site Controller/Site Manager for the integrity and safe condition of the structure, system and equipment allocated to him or her

Operation of the ISSoW within their area of responsibility

Countersignature of all categories of WCC within their area of responsibility and ensuring that the appropriate hazard and controls have been identified for the planned task.

STOP ALL UNSAFE WORK 4.12 HSE

The HSE responsible person ensures the appropriate level of management attention to health and safety. He/She is accountable for providing expert health, safety and specialist advice and guidance to management on their social and legal responsibilities for minimising loss to personnel, equipment, environment and the public for all departments and also confirming the requirements for health and safety expectations in the facility and STOPPING ALL UNSAFE WORK.

4.13 Authorised Gas Tester

A Competent Person, authorised and appointed by the Site Controller This Person:-

Tests for the presence of flammable or toxic gases and oxygen levels.

Records results within CoW/ISSoW as required.

STOPS ALL UNSAFE WORK

4.14 Work Party Members

The work party members do not have any specific role in using the electronic system, but have a crucial part to play in the safety of work by:

Actively participating in the Toolbox Talk Process following bpTT Permit To Work (PTW) Guidance Manual TRD 2145, to ensure they understand the hazards and control measures associated with the task, including the identification of any additional hazards and control measures required at the worksite

Demonstrating knowledge of and compliance with the site standards

Actively monitoring their worksites and surroundings for changes

Ensuring worksite is kept clean and safe during and on completion of task


4.15 Installation Administrator

Each Installation will have an Installation Administrator (Inst Admin) who is responsible for managing roles and privileges in the CoW/ISSoW software for the Installation

4.16 Node Administrator

The Node Administrator is responsible for administering the core Hazard and Control data within the system, subject to the bpTT Management of Change process. In addition, the Node Administrator has access to all users records for the installations within the node, and therefore, can assign roles for all users within the node.



This role is undertaken by the bpTT Operations Technical Authority.

4.17 Guest Role

There is also a Guest role, which enables any person with access to the company network to login into CoW/ISSoW with read only privilege. They can search, view and print WCCs, ICCs etc, but as they have read only privilege they cannot create, edit or conduct state change actions.

5.0 Handover of Responsibilities Effective handover between oncoming and off going personnel at shift and crew change is critical to ensure continuity is maintained and that there is no adverse impact on safety.

5.1 Shift Change

WCCs are valid until the end of the shift in which they were issued at which point they must normally be suspended by the off-going PA. If work is required to continue in the new shift, the following must happen

A shift handover will take place between the off going AA/PA and the oncoming AA/PA to ensure the current state of the plant is fully understood by the oncoming AA/PA. This will normally involve a worksite visit so that checks can be made prior to any WCC being issued for work in the area of accountability. The PA will then confirm, Controls in Place.

There may not be normally both a Dayshift and Nightshift Area Authority for most areas. Where the same person acts as both Day and Night shift AA, they will issue WCCs for work in their area, and they remain responsible, even if they are not on shift.

The oncoming PA then logs in and Accepts the WCC and thereby accepts responsibility of the work.

Note: Where the WCC requires a continuous presence of the PA, it may be necessary for the

responsibility to be transferred between PAs during a shift/period. In this case the oncoming PA is to countersign for the current shift to signify acceptance of responsibility.

5.2 Crew Change

5.2.1 Performing Authority If the PA who accepted the WCC is required to crew change, the WCC should be suspended. The only exception to this rule is where work is necessarily continuous, where another PA takes responsibility for the work by Countersigning the WCC. Note: Work cannot continue on a WCC unless the PA named on the WCC is actually in

charge of the work. 5.2.2 Area Authority The on-coming Area Authorities shall in the first instance review all Live WCCs in their Area of Accountability. The AA shall assess whether a worksite visit is necessary for any particular WCC in order to verify the adequacy of the control measures. If it is deemed that a worksite visit is required then the WCC-Permit shall be suspended until the inspection is carried out. Only when the AA is satisfied with the adequacy of the control measures shall he then Countersign the WCC.



Note: The worksite inspection may be delegated to a nominated competent person. 5.2.3 Site Controller / Site Manager The off going and oncoming Site Controller / Site Manager follow a similar process as the AA, as described above.



6.0 ISSoW Process This section describes the Control of Work/Integrated Safe System of Work (CoW/ISSoW) business process and the rules and the guidelines, which underpin the software.

6.1 WCC Permits

There are four categories of Permits, namely:

Hot Work Naked Flame (Valid for 1 day)

Hot Work Spark Potential (Valid for 7 days)

Cold Work (Valid for 7 days)

Cold Work Breaking Containment (Valid for 7days) Examples of activities covered by each category (but not limited to) are detailed below. 6.1.1 Hot Work WCC General Definition Hot work refers to any task that uses (or could create) a flame, spark or other energy discharge that might in turn ignite a fire or explosion.

It is normal practice to consider two types of hot work:

High Energy - Primary Source of Ignition (PSI). Identification and control of PSI hot work is required at all premises.

Lower Energy - Secondary Source of Ignition (SSI). Identification and control of SSI hot work is required only at premises where highly flammable liquids and gases are routinely present and processed, loaded/ discharged, stored in tanks, etc.

Primary source of ignition (PSI) - Hot Work Naked Flame PSI hot work is any work with equipment and tools that, when used in a normal manner, are likely to ignite a flammable or explosive atmosphere, solid materials and liquids. High energy is present in the form of a flame, electric-arc, incandescant sparks or the equipment has a surface temperature that exceeds 200C.

Typical PSIs are:

welding and burning

use of grinding/cutting discs

preheating or annealing welded fabrications, where the surface temperature may exceed 200C

stud welding

use of explosives

exposure of pyrophoric scale to air.

Secondary source of ignition (SSI) - Hot Work Spark Potential SSI hot work is work with equipment and tools that when used in a normal manner, or due to errors or malfunctions, may create lower-energy sparks and ignite a flammable or explosive atmosphere.

Typical SSIs include:



heat shrinking with an electrical heat gun

sandblasting, needle-gunning (possible static spark)

rotating steel brush

electrical isolation testing (megger testing)

maintenance of Ex electrical equipment (e.g. opening flameproof enclosures).

soldering equipment

friction spark, typically from a rusty surface

camera with battery/flash/motor

internal combustion engines

Note: Petrol engines have non-Ex ignition systems. Diesel engines can overspeed and fail mechanically, resulting in friction sparks. Vehicles with either type of engine will typically have other SSI electrical accessories, such as alternators, direction indicators, etc

mains or battery-powered electrical/electronic equipment not Ex-protected (see Glossary) according to the classification of the Hazardous Area in which they are used

6.1.2 Cold Work WCC Cold Work is a catch all category for tasks not included in other categories. Cold Work can involve a wide range of hazards, including:

non-routine lifting operations (at some premises a higher-than-normal authorisation may be required for heavy or very unusual lifts, in which case a separate Heavy/Unusual Lift Certificate may be used)

use of portable power tools and equipment (electric, air or hydraulic powered)

in-situ pressure testing

high pressure or ultra high pressure (UHP) water jetting, wet grit blasting or water cutting

work with radioactive sources fixed and mobile

stripping or disturbance of asbestos and other mineral fibres

temporary use of hazardous substances in areas not designed for this, e.g. cleaning and dosing tasks

work on vessels/equipment contaminated with Low Specific Activity (LSA) scale/Naturally Occurring Radioactive Materials (NORM)

painting, especially spray painting

civil and ground preparation works - a mandatory Permit is required (except for greenfield sites, see Section 4.3 Work Categories)

work near overhead electrical cables, or other unprotected live electrical equipment, e.g. in HV switching compounds or rooms

removal of handrails, gratings, hatches and fixed ladders

scaffolding erection/dismantling, or use of powered access

diving

use of Class 3(b) or open beam path laser equipment (e.g. lab applications)

temporary transfer of Area Authority responsibility for specific equipment or a location to another party (e.g. for construction work or well intervention)



work affecting the availability of fire and gas detection, alarm and emergency shutdown systems

work affecting key security systems, designed to protect the premises and/or personnel

work affecting the availability of fire/explosion and other emergency control or protection arrangements e.g. fixed fire fighting, fire/ballast pumps, fire main, emergency generator, external communications, etc.

work affecting main escape routes and/or systems (e.g. lifeboats)

6.1.3 Cold Work Breaking Containment - WCC

A Cold Work (Breaking Containment) WCC is intended to highlight the higher hazards of tasks which breach the designed containment envelope for hazardous process fluids these will typically be flammable fluids, but similar considerations apply for toxic and corrosive fluids, and those at high pressure. Highlighting such tasks assists in avoiding clashes with other work in the immediate vicinity. Cold Work (Breaking Containment) tasks include:

construction, maintenance, overhauls and repair work in operational areas involving breaking containment of hydrocarbon or other hazardous systems

spading and de-spading of systems normally under pressure

sampling of process fluids by any means other than a suitably designed and approved sample point.

6.2 Confined Space Entry (CSE) WCC

WCC Confined Space Entry (CSE) Certificates are used to define the conditions that are required for entry, and to certify that those conditions have been achieved. CSE Certificates do not allow any specific work to take place within a confined space.

The Confined Space Entry permit differs from the other permits in that:

a Level 2 RA is mandatory

provision is made for gas tests, including a continuation sheet

it does not permit any form of work, only visual inspection and gas testing

it requires to be authorised by the Site Controller / Site Manager

permit for Confined Space Entry involves declaring that the confined space is positively isolated so that the Authorised Gas Tester can enter, subject to any special conditions:

o authorising entry by the Authorised Gas Tester o recording the gas test and re-test results o declaring the confined space safe for entry o Specifying whether or not Breathing Apparatus is required o Written communication between the Authorised Gas Tester and Area Authority

Examples of confined spaces include closed tanks, vessels, vats, pits, and inadequately ventilated rooms. The bpTT procedure for Confined Space and Vessel Entry (Safe Work Practices Manual TRD 2147) describes the criteria for deciding if a space should be defined as a confined Space, and the procedure to be followed. A CSE is valid for 7 days.



6.3 WCC Routines

WCC Routines are similar in nature to WCC Permits, and have the same 4 categories of work (Hot Work Naked Flame; Hot Work Spark Potential; Cold Work; Cold Work Breaking Containment). Routines can be used for the more regularly occurring and lower risk tasks. When first created a Routine undergoes a Level 1 or Level 2 Risk Assessment in the same way as a Permit, but then when the Routine is required for work, it does not have to go through the full WCC approval process on every issue. The primary purpose of a Routine is to reduce the burden of lower risk activities on the CoW/ISSoW process enabling personnel to focus on potentially hazardous activities. Below is a list of typical Routine activities, although it should be noted that the list is not intended to be exhaustive and it will be up to each worksite to identify which tasks are acceptable to carry out under a routine. A WCC - Routine is normally required in the following circumstances:

Following minor repair and maintenance work on safety and emergency systems: i.e.

o Routine checks and tests which do not require isolating or inhibiting any part of the system.

o Minor work and checks that do not affect the integrity of the system.

Non-intrusive work on equipment that is already shut down.

Visual inspection of areas except in confined spaces.

Opening live electrical junction boxes in non-hazardous areas to carry out switching, testing to prove dead.

Opening, but not working on live electrical junction boxes in hazardous areas which contain only IS circuits.

Hand painting except where the paint or the area to be painted requires the use of an air fed mask.

Routine maintenance work, not requiring a Work Permit and covered by a written procedure.

Work on communication systems within telecommunications safe areas.

Work on computer controlled systems.

Re-lamping in non-hazardous areas.

Maintenance work on office equipment.

Use of non-certified portable electrical equipment, cameras etc and non-IS test equipment in hazardous areas (constant gas monitoring is mandatory).

6.4 Work that does not require WCC Authorisation

The following activities do not normally require to be authorised by a WCC (Permit or Routine) within the ISSoW process. However competent persons using approved procedures must carry out these tasks.

Routine production operations using approved operating procedures.

Routine drilling operations using approved procedures.

Routine Helideck operations using approved procedures.



Routine crane operations using approved procedures.

Routine hotel activities.

Routine office work in approved offices using approved procedures..

General cold work carried out in approved workshops by authorised personnel using drills, lathes, grinders etc.

Processes involving naked flames/hazardous substances in laboratories using approved procedures.

Routine maintenance of non-hazardous equipment in accommodation areas.

Operation of safety equipment for training purposes

6.5 Lifecycle of Work Control Certificates

The lifecycle of WCCs, including the authorisation states, levels and validity periods are described below: The primary states of a WCC are:

Requested

Pending

Authorised

Issued

Live

Job Complete

WCC Complete

Archived.

Refer to Addendum A Permit Lifecycle and Addendum B Routine Lifecycle

The different states of a WCC are represented by the Icon shapes as shown in Figure 1.



7.0 Isolations

7.1 Documentation of Isolations

The need for isolations shall be identified during the CoW/ISSoW planning process, and shall normally be carried out under the control of an Isolation Confirmation Certificate (ICC). The ICC should include a clear description of the reason for the isolation scheme and a detailed list of all isolation points (e.g. valves, blinds, vents and drains opened, breakers racked out, etc). A marked up P&ID or suitable drawing will be used to plan the isolation, and will be presented as part of the Authorisation process of the ICC, and accompany the ICC to the worksite.

The Isolation Confirmation Certificate (ICC) is used to control:

Process isolations and de-isolations

Electrical isolations and de-isolations

Control isolations and de-isolations

Sanction To Test (STT)

Retained Isolation (RI)

7.2 Electrical Isolations

All electrical isolations of plant shall be carried out in accordance with the bpTT Energy Isolation Electrical Standard TRD 2163 under the control of an ICC by an Authorised / Responsible Person Electrical (IAE within CoW/ISSoW)

A Responsible Person Electrical must countersign the isolation scheme to verify when the work involves:

On high voltage electrical equipment

On low voltage multi-point feed equipment

Where a circuit main earth is to be applied to any part of the electrical system

7.3 Process Isolations

Process Isolation standards and methods are described in the bpTT SIRPS Manual TRD 2143.

If the isolation cannot meet the defined minimum standard, then an isolation Risk Assessment must be conducted to justify working to a lower level. This must clearly identify what additional control measures are being applied to reduce the risk to an acceptable level. This risk assessment will be carried out using the Risk Assessment Process that is integral to the CoW/ ISSoW software, and must be approved by the Site Controller.

7.4 Personal Isolations

Within CoW/ISSoW there is the facility for Personal Isolations, subject to the requirements of the bpTT SIRPS Manual TRD 2143 being met. A WCC that references Personal isolations must be Verified and Authorised in the normal way.

7.5 Lifecycle of an ICC

The ICC contains a listing of all isolation points that the Area Authority (AA) must Verify, before giving permission to the relevant Isolating Authority (IA) to Perform the isolation. The relevant IA then signs off against each isolation point to confirm that the isolation has been applied and that the isolations are in place. Only then can the AA issue the referenced WCC.



The ICC remains in force until all WCCs associated with the ICC have been taken to Complete State.

Refer to Addendum C - ICC Lifecycle for detail

7.6 Sanction to Test (STT)

A Sanction to Test (STT) is to be used when there is a requirement to de-isolate all or part of an isolation boundary covered by an Isolation Confirmation Certificate (ICC) in order to conduct an operation/integrity test, without the need to cancel the referenced WCC.

Note: As this process requires the removal or partial removal of the isolations before the total scope of work is completed, it must be tightly controlled. All STT isolations must be approved by the AA

The isolation points required to be temporarily de-isolated must be reviewed with the AA and the IA, then the referenced WCC shall be Suspended for STT (and any other associated WCCs affected by the STT).

Once the AA has given approval for the STT, the relevant IA can de-isolate the relevant isolation points. After the initial de-isolation has taken place the referenced WCC can be then Issued for STT.

On successful completion of the test, the isolation points can be re-isolated to allow continued work under the original WCC. This approval, de-isolation and subsequent re-isolation are recorded on the ICC.

However, if a successful STT marks the end of the scope of work of the WCC, then these isolation points do not need to be re-isolated, but can be moved to final de-isolation.

Note: A step-by-step guide on how to conduct a STT can be seen in the Resource Centre.

7.7 Long Term Isolations (LTI)

In circumstances where it is not possible to continue the work under a WCC (e.g. waiting for spare parts), the ICC has to be retained. The AA will ensure that the WCC assigned for this work will be either complete or not complete. The AA will then move the ICC to LTI where it will remain in the LTI Register until such time that it has to be re-activated. The ICC will undergo a Review every 7 days and an Audit every 90 days.

7.8 Boundary Isolations

Where Multiple WCCs are carried out against a common isolation, this is designated a boundary isolation, this is in accordance with bpTT SIRPS Manual TRD 2143. Where boundary isolation is used then each WCC must be referenced to the ICC. All of the referenced WCCs must be cancelled before the isolation can be removed.



8.0 Supporting Processes

8.1 Paper Based Back up system

A paper based back up system exists which provides an interim control should there, in the unlikely event, be a failure of the software system. This should be kept in the permit office and comes in pre printed pads.

8.2 Additional Paper Certification

Where additional paper certification / documentation are used in support of a Work Control Certificate (WCC), then they should be referenced on the WCC and attached in paper form. The following are some examples of supporting certification/documentation:

COSHH Assessment

Safety System Inhibits

P&IDs

LO/LC valve status log.

Leak pressure test certificate

Ground disturbance certificate

8.3 Operations within the 500m Zone

Activities within any Installations 500m zone, e.g. diving or pipe laying operations, are controlled under CoW/ISSoW and will be carried out under an appropriate WCC.

Any vessel carrying out these activities must maintain close communication with the Installation at all times and must not carry out any work until approval by the SC, excluding routine supply vessel operations.

A WCC will be generated and administered for work within the 500m zone as follows:

1. The company representative on the vessel will contact the Installation and discuss the proposed operation with the designated AA.

2. The AA or his designate will create the WCC identifying the correct hazards and controls for the operation.

3. The WCC will go through the normal approval process on the Installation.

4. When the Company Representative is ready to commence operations they will contact the AA who will issue the WCC to a designated person, normally the Control Room Operator, who will accept to take the WCC live. A copy will then be sent to the vessel where the Company Representative will sign the copy and send it back by way of acceptance (this can be done via fax or e-mail).

5. On suspension of work the Company Representative will inform the AA who will have the WCC suspended. A copy of the status should then be sent to the Company Representative on the vessel who will append their signature in confirmation and send it back to the AA/Performing Authority (PA).



6. On completion of the task and communication from the Company Representative that operations have been completed, the WCC will be moved to job complete.

7. A copy showing the signature of the PA will be sent to the Company Representative on the vessel who will append their signature and send it back to the AA/PA, acknowledging the completion of the task.

Any work being undertaken on subsea templates out with the 500m zone would still have the same principle as above applied. This is reflected within bpTT Sub-Sea Operating Practice (Diving Operations) TRD 2167.



9.0 Risk Assessment Process

9.1 Glossary of Terms

Competent Person A person who by reason of his/her training, knowledge, experience and judgement is considered by management to be capable of adequately assessing health and safety risks for the activity in question. Control Measures Actions necessary to prevent hazards from causing harm Hazard The potential to cause harm Hazard Effect The severity of the likely consequence if an incident occurs. Probability The possibility of an event happening should controls fail expressed as unlikely, low, medium, or high. Reasonably Practicable This term implies that an estimation of the risk must be made. If the cost or difficulty of a precaution is grossly out of proportion to the reduction in risk likely to be achieved by implementing it, the precaution can be considered not reasonably practicable. Any additional risks which may arise while implementing or removing the precaution must also be taken into consideration in determining what is reasonably practicable. Risk The product of hazard effect and likelihood Initial Risk before control measures have been identified Residual Risk after control measures have been identified Risk Assessment The process of hazard identification assessment and reduction of risk to an acceptable level for any activity that is to be carried out. CoW/ISSoW has two levels of risk assessment - L1RA and L2RA. Risk Assessment Matrix A pictorial method of indicating the results of a risk assessment.

9.2 Risk Assessment Process

Almost any person employed at a bpTT site can be requested to participate in Risk Assessments. The company is responsible for the provision of training to a level that permits risk assessment participants to contribute effectively to the process. The Major Accident Hazard Management Team (MAHAMS) shall be responsible for the custody and maintenance of the Policy and Guidance on Management of Risk STP-IM-009 with the provision for a risk assessment and advisory service as required. The Risk Assessment Process is an integral part of all WCCs and is categorised into two levels.



9.2.1 Level 1 (L1RA) A single person may carry out this type of assessment (with input from others as required) in accordance with the guidelines set out within the bpTT Policy and Guidance on Management of Risk STP-IM-009. If it is deemed that the L1RA is not sufficient to control the identified hazards then a L2RA must be conducted. The software will prompt the user to this effect. Examples of Work that may be undertaken using a L1RA are listed below:

Following minor repair and maintenance work on safety and emergency systems: i.e.

o Routine checks and tests which do not require isolating or inhibiting any part of the system.

o Minor work and checks, which do not affect the integrity of the system.

o Non-intrusive work on equipment, which is already shut down.

Visual inspection of areas except in confined spaces.

Opening live electrical junction boxes in non-hazardous areas to carry out switching, testing to prove dead.

Opening, but not working on live electrical junction boxes in hazardous areas which contain only IS circuits.

Hand painting except where the paint or the area to be painted requires the use of an air fed mask.

Routine maintenance work, not requiring a Work Permit and covered by a written procedure.

Work on communication systems within telecommunications safe areas.

Work on computer controlled systems.

Re-lamping in non-hazardous areas.

Maintenance work on office equipment.

Use of non-certified portable electrical equipment, cameras etc and non-IS test equipment in hazardous areas (constant gas monitoring is mandatory).

If in any doubt, conduct a level 2 Risk Assessment. 9.2.2 Level 2 (L2RA) This is a team based risk assessment with a minimum of three members. There are some WCC types and categories where a L2RA is mandatory.

All Hot Work Naked Flame - Permits. Confined Space Entry WCCs.

These are described within bpTT Policy and Guidance on Management of Risk STP-IM-009. It should also be noted that for some tasks a risk assessment may require to be conducted offsite as well as at the installation / site itself.

9.3 Other Types of Risk Assessment Conducted in ISSoW

In addition there is the facility to conduct Stand Alone Risk Assessments (SARA), Operational Risk Assessments (ORA).



9.3.1 Standalone Risk Assessment (SARA) - WCC A Standalone Risk Assessment is slightly different from the other WCC types as it involves carrying out a risk assessment, which may not be associated with either a task or specific piece of equipment. It could for example involve performing a risk assessment associated with a change in organisation or responsibilities. It allows direct use of the standard Level 2 Risk Assessment process. The system has the ability to highlight controls required as being prerequisite. This function will not allow the WCC or SCC to proceed to the next level until the controls have been confirmed to be in place. 9.3.2 Operational Risk Assessment (ORA) - WCC Many of the current Operational Instructions are associated with operating plant or equipment as opposed to work on that plant or equipment, and a WCC - Operational Risk Assessment (ORA) is designed to meet this need by utilising the L2RA process to:- Identify the risk associated with continued operation given that < 100% system

protection is available. Identify controls needed to permit continued safe operation. It also provides a visible

and auditable approval process.

9.4 Planning

9.4.1 Collating Information The Permit Requestor must check ISSoW to determine if a WCC and its assessment for the activity already exists. If an assessment has been carried out previously, this must be reviewed by the Permit Requestor and other relevant personnel to establish if it is still valid. If so, the WCC (with its assessment) can be copied, and submitted for Verification. If it is not, a new assessment will be required. If a new Task Risk Assessment is required, the Requestor must collate all relevant information including work packs, drawings and other documentation for the activity being assessed. 9.4.2 The Risk Assessment Team (Level 2 RA) A team composed of competent persons who have knowledge and experience relevant to the activity must carry out the Level 2 Risk Assessment. The team will typically include the following:

Requestor Area Authority Performing Authority Isolating Authority

Other appropriate personnel who have specialist knowledge of the activity 9.4.3 Level 2 Risk Assessment The team will carry out the Level 2 Risk Assessment using the CoW/ISSoW programme. Having identified the hazards associated with the activity, the Team must establish effective controls to ensure that the Residual Risk is as low as reasonably practicable using the list associated with each group of Hazards.



Should the listings not capture all controls required then there is a facility to input additional controls should the need arise. 9.4.4 Work Co-ordination All proposed work activities must be discussed at daily planning meetings to ensure that all relevant personnel are aware of the nature and extent of the work. The Permit Requestor must ensure that sufficient resources are available to undertake the work safely. The interactions with other operations must be addressed at this stage.

9.5 Risk Assessment Matrix

ISSoW features one Risk Matrix that combines Safety, Environment and Business consequence as factors to consider when evaluating hazards and risk. This can be accessed via the Level 2 Risk Assessment section within ISSoW, and is shown at Figure 3. The three categories contained within the matrix are defined as follows: Low (3 or less) The risk is acceptable if it is managed Medium (4 and 5) The risk is tolerable if it has been reduced to ALARP High (6 and above) The risk is not acceptable under any circumstance The Initial Risk before controls are put in place will be categorised according to the matrix levels Low, Medium and High The Residual Risk will also be categorised after controls have been identified. These can be used for comparison to evaluate the reduction in risk due to the control measures being implemented. Once all of the control measures have been identified, the following factors should be considered when assessing the Residual Risk:

Have all the necessary controls been identified? Are they appropriate for the hazards involved with the task? Are any additional competencies required to complete the task? Is the residual risk effectively controlled?

Where the Residual Risk is judged to be acceptable and as low as reasonably practicable (ALARP), the team will recommend that the work should go ahead with the identified control measures in place. This must be a unanimous decision of the whole team and is reflected in the tick box stating ALARP. If this is not the case, the work content must be re-considered before re-assessment takes place. The AA and SC when they respectively Verify and Authorise a WCC must ensure that a suitable and sufficient risk assessment has been performed and that adequate controls have been identified to reduce the risks, and their electronic signatures are captured within the ISSoW system. Changes that may affect Risk Assessment If during the course of work being performed any conditions change that may affect the suitability of the control measures in place to reduce the risk then the work will be stopped. A Competent Person will make an assessment as to whether the Risk Assessment should be



revisited or the work held until conditions return to those under which the Risk Assessment and any Permit to Work were issued. Training in Task Risk Assessment is provided as follows:

Training for bpTT Staff may be arranged through training administration.

The Contract Sponsor must agree contractor Contractors Training requests and, thereafter, the Focal Point will make the arrangements.

Additional training may be provided as and when required. The flowchart in Figure 2 illustrates the process flow through the various options and stages of the Task Risk Assessment Process. The purpose of this process is to provide a structured approach to task risk assessment and to meet the regulatory and bpTT Policy and Guidance on Management of Risk STP-IM-009.



Figure 1 CoW/ISSoW Icon Shapes and Colours Icons Definition

Requested Incomplete

Requested

Pending

Authorised

Suspended

Suspended STT

Issued

Pre-issue & Pre-live

Issued STT

Live (the icon will flash if Overdue)

Live STT (the icon will flash if Overdue)

Continuation Pre-issue & Continuation Pre-live

Job Complete

Job Incomplete

Exceeded Validity

WCC Complete

Archive

Retained Archive

Approved Routine Template

All the above icons will be shown with a flashing border if they cover multiple areas. The category of a WCC is shown by the Colour of the fill in the icon. In the examples above they are all Hot Work (Naked Flame) Permits (i.e. positive source of ignition) The other categories are:

Hot Work (Spark Potential) Permits (i.e. potential source of ignition).

Cold Work.

Cold Work - Breaking Containment.

Routines are shown as split icons where the colour in the left of the split denotes the category.

Confined Space Entry Certificate



Figure 2 - Risk Assessment Flow Chart

WORK REQUEST

CHECK TASKCATEGORY

MANDATORY?

PERFORM LEVEL-1TRA

DEFINE TASKPARAMETER

LEVEL-2 TRA

FORM TRA TEAM

BREAK DOWNACTIVITIES

IDENTIFY HAZARDSFor each activity

FIND ASSOCIATEDHAZARDS

For each activity

IDENTIFYCONSEQUENCES

For each hazard

DEFINE RISK RATINGS

IDENTIFY CONTROLS

RESIDUAL RISKACCEPTABLE

CONTROLSADEQUATE?

AGREEMENT ON RISKS &CONTROLS

DOCUMENT & RECORD

APPROVAL TO PROCEED

TRA COPIES TO ALLINVOLVED

IMPLEMENTCONTROLS

CARRYOUT TASK

MONITOR FORCONDITION CHANGE STOP

RE-ASSESS IFREQUIRED

RECORD LESSONSLEARNED

YES

YES

NO

NO

NO

IF CONDITIONSCHANGE

YES

HIGH ORMEDIUM RISK

LO

W R

ISK

LEVEL-1

a) All new activitiesb) All jobs at planning and design stagec) Repeated activities, if condition is changedd) Annual review for repeated activities

LEVEL-2 (MANDATORY)

a) Confined Space Entry (including vessel cleaning)b) Excavations greater than 4 feet deepc) Working at heights > 6 feet (including erection of structures for this work)d) Hot Work in Hazardous Arease) Failure to meet minimum isolation requirementsf) Complex lifting operations involving multiple suspensions or lifting near live plantg) Any activity with potential H2S exposureh) Where multiple protective devices are removed or inhibited from a systemi) Simultaneous operationsj) Mud plugging and Hot tappingk) Deviation from an existing policy, procedure, or practicel) Mandatory for activities where risk assessment is medium or high

6.1

6.2

6.3

6.4

6.5

6.6

6.7

6.8

6.9

6.8

6.10

6.11

6.12

6.13

6.14

6.15

6.16

6.17

6.18

6.196.20

6.21



Figure 3 - bpTT Risk Assessment Matrix.

Likelihood Category

Cat Level Frequency of Occurrence F (continuous Operation) per year of facility operations

Probability of Occurrence P (single operation) during the operation

E Continuous Once or more per quarter F > 1/yr Very likely to occur more than once P > 1.0

D Very High Once per year F ~ 1/yr Certain to occur at least once P ~ 1.0

C High Less than once per year F < 0.1/yr Less than 1 in 10 chance of occurring P < 0.1

B Medium Less than once in 10 years F < 0.01/yr Less than 1 in 100 chance of occurring P < 0.01

A Low Less than once in 1000 years F < 0.001/yr Less than 1 in 1000 chance of occurring P < 0.001

Consequence Category

Cat Level safety Environment Business

5 Catastrophic >10 fatalities Oil or chemical spill > 5000 Barrels (US > $100M (US)

4 Very High 2-10 fatalities Oil or chemical spill 1000 -5000 Barrels (US) $10M - $100M (US)

3 High Single fatality Oil or chemical spill 100 -1000 Barrels (US) $1M - $10M (US)

2 Medium Permanent Disability DAFWC / Hospital stay Oil or chemical spill 10 -100 Barrels (US) $0.1M - $1M (US)

1 Low First aid case Oil or chemical spill 1 -10 Barrels (US) $10,000 S 0.1M (US)

5 5 6 7 8 9

4 4 5 6 7 8

3 3 4 5 6 7

2 2 3 4 5 6

1 1 2 3 4 5A B C D E

Likelihood

Consequences



Addendum A - Permit & CSE Lifecycle



Addendum B - Routine Lifecycle



Addendum C - ICC Lifecycle



10.0 Control of Work Standard Intent The intent of this Standard is to ensure there is a formal approach to managing work risk for bp employees and bp Companies and their contractors. The further intent is to promote adoption of the Standard by companies working on behalf of bp on non bp Premises. bp should endeavour to hire contractors with CoW programs that are as protective, or more protective, than this Standard and encourage those who do not have such a program to adopt one. Purpose The purpose of this Control of Work (CoW) Standard is to reduce the risk to which our workforce is exposed and the potential for harm to others. The Standard will strengthen the Groups ability to deliver HSSE Performance by defining the Mandatory Requirements required of any CoW process. The Group Standard Personal Safety - Control of Work (CoW) requires compliance with the following 12 Elements: 1. A written policy shall exist describing the CoW process. 2. All identified roles within the CoW policy and associated procedures shall have defined accountabilities. 3. All persons involved in the CoW process shall be appropriately trained and competent to carry out their roles. 4. Planning and scheduling of work shall identify individual tasks and their interaction. 5. Tasks shall not be conducted without being risk assessed. 6. Before conducting work that involves confined space entry, work on energy systems, ground disturbance, hot work or other hazardous activities, a permit shall be obtained. 7. The scope, hazards, controls and mitigations shall be communicated in writing and signed off by all involved in the task. 8. All ongoing work requiring a permit shall be regularly monitored and managed by a responsible person. 9. The work site shall be left in a safe condition on completion or interruption of the work. 10. The CoW process shall be subject to a program of regular auditing. 11. Internal and External lessons learned that impact the CoW process shall be captured, incorporated, and shared. 12. The CoW policy and associated procedures shall make it clear to everyone that they have the obligation and authority to stop unsafe work.



11.0 Golden Rules of Safety The purpose The Golden Rules of Safety cover the following activities:

Permit to work Energy isolation Ground disturbance Confined space entry Working at heights Lifting operations Driving safety Management of change

They are the minimum standards for safeguarding personal safety and the key controls and procedures that must be followed in all places of work. These rules have been prepared to allow the learning from past safety incidents to be shared widely across bp and emphasize the basic rules that should be in place in all locations for managing safety during typical risk activities. The Golden Rules of Safety must be strictly enforced to ensure the safety of our people and the communities in which we live. They also provide a basis of safe practice for managing risks outside of work activities. Everyone should be aware of these rules and follow them. Management are accountable for communicating, training, implementing and auditing them to assure compliance. Permit to work Before conducting work that involves confined space entry, work on energy systems, ground disturbance in locations where buried hazards may exist, or hot work in potentially explosive environments, a permit must be obtained that: defines scope of work identifies hazards and assesses risk establishes control measures to eliminate or mitigate hazards links the work to other associated work permits or simultaneous operations is authorised by the responsible person(s) communicates above information to all involved in the work ensures adequate control over the return to normal operations. A permit to work must be used whenever abnormal or high-risk work is to be carried out, or where specific circumstances require protection above that which normal working conditions provide. The permit provides written confirmation that a risk assessment of the specific conditions affecting the work has been carried out and that appropriate control measures to protect personnel and equipment from each of the hazards have been provided. It is a formal agreement between the permit authority (responsible person) and those who will carry out the work that both the risks and the controls that will mitigate them are understood and that the controls will be fully implemented.

Formatted: Bullets and Numbering



Sign it only when you are happy that you understand all the requirements. Energy isolation Any isolation of energy systems; mechanical, electrical, process, hydraulic and others, cannot proceed unless: the method of isolation and discharge of stored energy are agreed and executed by a

competent person(s) any stored energy is discharged a system of locks and tags is utilized at isolation points a test is conducted to ensure the isolation is effective isolation effectiveness is periodically monitored. An energy source in this context includes any electrical, mechanical, hydraulic, pneumatic, gravitational, chemical, nuclear, thermal or other energy source that could cause injury. Energy sources must be isolated whenever servicing or performing maintenance on machines and equipment in which the unexpected energisation or start up, or the release of stored energy could cause injury. Note that this Golden Rule will be applied in conjunction with local rules and procedures, which may in turn be influenced by specific regulations in the country of operation, or codes of practice that apply to a particular industry sector. Ground disturbance Work that involves a man-made cut, cavity, trench or depression in the earths surface formed by earth removal cannot proceed unless: a hazard assessment of the work site is completed by the competent person(s) all underground hazards, i.e. pipelines, electric cables, etc., have been identified, located

and, if necessary, isolated. Where persons are to enter an excavation: a confined space entry permit must be issued if the entry meets the confined space

definition ground movement must be controlled and collapse prevented by systematically shoring,

sloping, benching, etc., as appropriate ground and environmental conditions must be continuously monitored for change. Ground excavation must not commence until it has been authorized by a competent person, i.e. one who can identify the hazards and put in place the right measures to control them.

Particular care is required if members of the workforce are required to enter the excavation, and conditions must be monitored during their entry to make sure that they are not endangered by changes in soil stability as a result of the weather or other work that is going on. Confined space entry Entry into any confined space cannot proceed unless: all other options have been ruled out







permit is issued with authorization by a responsible person(s) permit is communicated to all affected personnel and posted, as required all persons involved are competent to do the work all sources of energy affecting the space have been isolated testing of atmospheres is conducted, verified and repeated as often as defined by the risk

assessment stand-by person is stationed unauthorized entry is prevented A confined space is one that is large enough for personnel to enter, has limited or restricted means of entry, and is not designed for normal or continuous occupancy. It can be any space of an enclosed nature where there is a risk of death or serious injury from hazardous substances or dangerous conditions (e.g. lack of oxygen). Entry to such spaces must be controlled, and only authorized following a risk assessment and the establishment of controls over the hazards. In particular, the quality of the atmosphere inside the space must be subject the stringent monitoring. On some occasions when it becomes necessary to work in an inert atmosphere, specialist teams and very rigid procedures are required for personnel both in the vessel and in the vicinity of it where the atmosphere may still be unsafe. Working at heights Working at heights of 2 metres (6 feet) or higher above the ground cannot proceed unless: a fixed platform is used with guard or hand rails, verified by a competent person, or fall arrest equipment is used that is capable of supporting at least a 2275 kg (5000 lbs)

static load per person and has: - a proper anchor, mounted preferably overhead - full body harness using double latch self locking snap hooks at each connection - synthetic fibre lanyards - shock absorber fall arrest equipment will limit free fall to 2 metres (6 feet) or less a visual inspection of the fall arrest equipment and system is completed and any

equipment that is damaged or has been activated is taken out of service. person(s) are competent to perform the work The precautions required for working safely at height are very straightforward so it is disappointing that accidents during such operations are rather common. Each business unit must have a Fall Protection Policy based on the above rule, taking into account the specific risks that are involved, and also the national, regional and industry sector regulations that may apply. Remember that every office has windows to clean and a roof to maintain, so the potential is there in just about every location. Lifting operations Lifts utilizing cranes, hoists, or other mechanical lifting devices will not commence unless: an assessment of the lift has been completed and the lift method and equipment has

been determined by a competent person(s) operators of powered lifting devices are trained and certified for that equipment rigging of the load is carried out by a competent person(s) lifting devices and equipment have been certified for use within the last 12 months (at a

minimum) load does not exceed dynamic and/or static capacities of the lifting equipment




Deleted: , very rare



any safety devices installed on lifting equipment are operational all lifting devices and equipment have been visually examined before each lift by a

competent person(s). Lifting, whether using simple hand operated mechanical devices or more complex ones, must only be carried out by trained and competent persons using approved and recently inspected equipment. The area underneath the lift is under control and clear of unnecessary persons or equipment. Each business unit must specify its own clear rules for lifting; dependant on the type and frequency of lifting operations that are involved, and taking into account both regulatory requirements and industry good practice. Driving Safety All categories of vehicle, including self-propelled mobile plant, must not be operated unless: vehicle is fit for purpose, inspected and confirmed to be in safe working order number of passengers does not exceed manufacturers design specification for the

vehicle loads are secure and do not exceed manufacturers design specifications or legal limits

for the vehicle seat belts are installed and worn by all occupants safety helmets are worn by riders and passengers of motorcycles, bicycles, quads, snow-

mobiles and similar types of vehicle. Drivers must not be authorized to operate the vehicle unless: they are trained, certified and medically fit to operate the class of vehicle they are not under the influence of alcohol or drugs, and are not suffering from fatigue they do not use hand-held cell phones and radios while driving (best practice is to switch

off all phones and two-way radios when driving). Operation of road transport, of all kinds, light vehicles, heavy vehicles, or self-propelled mobile plant on or off-road, is the source of the greatest number of serious accidents and fatalities, both for BP and for the world in general The two key components of getting road safety right are: access to the right vehicles with appropriate equipment, standards, procedures; and the quality of the training and competencies of drivers together with their behaviours and attitudes. Management of change Work arising from temporary and permanent changes to organization, personnel, systems, process, procedures, equipment, products, materials or substances, and laws and regulations cannot proceed unless a Management of Change process is completed, where applicable, to include: a risk assessment conducted by all impacted by the change development of a work plan that clearly specifies the timescale for the change and any

control measures to be implemented regarding: - equipment, facilities and process - operations, maintenance, inspection procedures - training, personnel and communication - documentation authorisation of the work plan by the responsible person(s) through completion.







Deleted: A crucial third element is the support and leadership shown by management in creating the right environment for safe driving. Alternative last sentence:The leadership will come from management, who must support the road safety effort by creating the right environment for safe driving.



Ensuring systematic Management of Change (MOC) is a key part of Process Safety Management (PSM) and the detailed processes that are necessary will be covered in site and business documentation elsewhere. Failure to identify and control the potential hazards that are associated with changes has led to a number of catastrophic incidents, and many others that have caused great harm to people and facilities. As a result, it is vital that everyone understands what is meant by a change and is aware of the MOC process. Every affected person must be briefed on the control measures that are to be put in place to manage any proposed change.

12.0 Site Standards

These Site Standards are mandatory in bpTT

Failure to comply with these standards will result in disciplinary action

NO ACCIDENTS NO HARM TO PEOPLE

NO DAMAGE TO THE ENVIRONMENT

12.1 Beachfield Site Standards

Rules for Personnel & Vehicle Operators These Site Standards are mandatory and apply to all persons entering the Beachfield site. Failure to comply with these standards may result in disciplinary action and/or removal from the site. Fairplay All the requirements stated within this booklet shall be followed. The rules of Fair-play will determine the appropriate action for non-conformers. We will adhere to

Getting HSSE right BP Golden Safety Rules Control of Work plan bpTTs 6+ prominent Risks Standards

The following items are prohibited Matches, cigarettes, lighters, drugs, alcohol, pagers, cell phones, cameras, jewellery, firearms, non-intrinsically safe radios or electronic equipment, combustible materials, poisonous chemicals and all items deemed unsafe for use on the plant by operations. Plant Security

Entry to the plant

Documents

Bptt Cow Issow Handbook