IOG Element1

7/23/2019 IOG Element1

http://slidepdf.com/reader/full/iog-element1 1/117

SHEilds Ltd www.sheilds.org eLearning: www.sheilds-elearning.com Tel: +44(0)1482 806805

NEBOSH Oil & Gas Cert Element 1 v 2.0 (169/03/2015) Page: 1

NEBOSH International TechnicalCertificate in Oil & Gas OperationalSafety (Element 1)

Please be advised that the course material is regularly reviewed and updated on the eLearning

platform. SHEilds would like to inform students downloading these printable notes and using these

from which to study that we cannot ensure the accuracy subsequent to the date of printing. It is

therefore important to access the eLearning environment regularly to ensure we can track your

progress and to ensure you have the most up to date materials.

Version 2.0 (16/03/2015)

http://www.sheilds.org/



http://www.sheilds-elearning.com/









1.0 - Health, Safety and Environmental Management in Context.

Element 1: Health, Safety and environmental management in context.

Specific intended learning outcomes:

On completion of this element, candidates should be able to demonstrate an

understanding and knowledge of familiar and unfamiliar situations in the oil & gas industry.

In particular you should be able to:

1.0 - Explain the purpose of and procedures for investigating incidents and how lessons

learnt can be used to improve Health & Safety in the oil & gas industry.

2.0 - Explain the hazards inherent in oil & gas arising from the extraction, storage and

processing of raw materials and products.

3.0 - Outline risk management techniques used in the oil & gas industries.

4.0 - Explain the purpose and content of an organisation's documented evidence to provide

a convincing and valid argument that a system is adequately safe in the oil & gas industries.

Recommended tuition time:

Recommended tuition time for this unit is not less than 12 hours.

1.1 - Learning from Incidents.

The Oil and Gas Industry generally has a good safety record. Unfortunately from time to

time, incidents occur. Sometimes, sadly, with catastrophic consequences in terms of loss of

life, damage to assets and harm to the environment (for example: Piper Alpha, BP Deep

Water Horizon, BP Texas City and Esso Longford). Learning from incidents is, therefore, a

vital part of an effective accident prevention programme.

In order to learn from incidents, we need to ensure an effective system is in place to

investigate both incidents and near misses in order to determine the immediate and root

causes so that proper action can be taken to prevent recurrence.

There are many reasons for investigating accidents and incidents:

To identify the immediate and root causes in order to prevent recurrence.

To learn lessons and communicate these internally and across industry.

To ultimately improve standards of health and safety.

To enable safety management systems to be improved.

To demonstrate concern to workforce. Legal and regulatory compliance. It is required by law.













1.1 - Learning from Incidents.

Important Terminology.

Accident:

An unplanned, unwanted event that results in injury, ill health, damage to plant or

equipment, or some other loss.

Near Miss:

An unplanned, unwanted event that had the potential to cause injury, ill health, damage to

plant or equipment, or some other loss.

Ill Health:

A disease or medical condition that is attributable to a work activity (for example:

dermatitis, as a result of exposure to petroleum products).

1.2 - Why Prevent Incidents?

We want to prevent incidents for the following reasons:

To prevent unwanted and unintended impacts on the safety or health of people.

To prevent asset damage and financial losses for stake holders.

To prevent negative impact on the environment.

For legal and regulatory compliance.

To maintain the 'license to operate' granted by the enforcing authority.

To improve safety, reliability and effectiveness of operations.

To maintain a good public reputation and relations.

Other than the employer, there may be other parties who wish to investigate the incident:

The enforcement authority (HSE, OSHA, Environment Agency etc.).

Insurance companies.

The coroner (in the event of a death).

Trade Unions.

The press or investigative journalists (although they will not necessarily be allowed

complete access).

1.3 - The Benefits of a High Quality Incident Investigation.

Incident investigations can lead to several direct benefits:

An improvement of the management systems: If an accident has occurred, this may

be the result of a management system failure. The accident investigation should look













1.3 - The Benefits of a High Quality Incident Investigation.

into the effectiveness of management systems and make recommendations on

improvements that can be made.

Learning of important lessons:. When the failure has been identified, are there

lessons that can be learnt and applied in other areas? These may be common

technical issues shared by other departments or companies using similar plant, or

management system failures that may be systemic across the organisation or

industry.

Improved safety performance: By correcting the safety failures that lead to incidents,

ultimately there will be fewer incidents over the long term.

In turn these benefits will lead to other benefits such as improved productivity as a result of

less downtime caused by incidents. They will result in increased uptime and reliability, and

financial costs will be less as a result of less product damage, less absenteeism, lesscompensation paid to injured employees, less time wasted in accident investigations, fewer

prosecutions and enforcement action etc.

1.4 - Incident Investigation.

To learn from incidents we need to ensure an effective system is in place to investigate

incidents and significant near misses to determine the root causes so that proper action can

be taken to prevent recurrence.

For the purposes of the exam you must be able to:

Describe the basic steps in an incident investigation.

Recognise and distinguish the quality of the investigation.

Describe process for sharing of incident and near miss lessons learnt.

Understand what the term ' root cause' means.

Describe and communicate requirements for investigation of contractor incidents.

1.5 - Buncefield Video: Learning from Incidents.

Download Video

On December 10th 2005 there was a major explosion and fire at the Buncefield oil storage

depot in the United Kingdom. It was the largest fire in the UK since the Second World War.

The subsequent investigation identified a large number of immediate and root causes

which helped, not just the organisations involved but the entire oil and gas industry,

improve their technical control measures and management systems.

The root causes identified included:

Failures of management and contractors to repair a faulty level gauge.







http://sheilds-elearning.com/pluginfile.php/1200/mod_folder/content/0/element1/buncefield_x264.mp4?forcedownload=1









1.5 - Buncefield Video: Learning from Incidents.

Inadequate design and maintenance of secondary and tertiary containment

measures (i.e. the bund and catchment drains).

The management systems related to tank filling were deficient and not properly

followed.

Insufficient control and information for staff to properly control the filling of the

tanks.

Excessive pressure placed on staff due to an increase in workload, resulting in their

inability to manage the receipt and storage of fuel.

The focus was on keeping the process operating and not on process safety.

1.6 - Management Involvement in Investigations.

Incident investigation guidelines and procedures are typically developed by senior

management. However, first and second line supervisors and managers should play an

active role in carrying out incident investigations. They are familiar with the work practices

and have control over the area. In addition, they should ensure that the recommendations

resulting from incident investigations are implemented as soon as possible. Without the

cooperation and commitment of the line managers the investigation will be of poor quality

and it is unlikely any real changes will be implemented or sustained.

1.7 - Incident Management Cycle.

Figure 1. Incident Management Cycle.

The Incident Management Cycle is a simple way of understanding the order of actions

which we carry out after an incident.

1. Imagine that an incident has occurred. BEFORE we tend to the casualty, we have to

ensure the situation cannot get any worse. This is to ensure any rescuers or medical















1.8 - Basic Accident Investigation Process.

doesn't ignite, or result in injury) as it is to investigate a lost time or serious injury incident.

Just because an incident did not result in significant harm or damage, does not mean that it

should be ignored. Had the circumstances been slightly different, the actual severity may

have been much higher.

The UK HSE offers guidance on the basic accident investigation process (click on this link to

read it in full: HSG 245: Investigating Accidents and Incidents). It recommends a 4 step

approach:

Step 1: Gather the information.

Step 2: Analyse the information. Determine the Immediate and Root causes.

Step 3: Identify suitable risk control measures.

Step 4: Develop an action plan, and implement.

However, before the Investigation can start, there are some basic emergency response

actions that must be taken:

1. Render the area safe.

2. Ensure that first aid treatment is given to any injured persons.

Once these actions have been taken, a decision needs to be made regarding the type and

level of investigation to be undertaken. As discussed above, in determining the level of

investigation you must consider the worst potential consequences of the incident, NOT the

actual outcome. (e.g. a scaffold collapse may not have caused any injuries, but had the

potential to cause major or fatal injuries). A risk matrix is sometimes used for this purpose.

See an example of a risk matrix here: http://www.hse.gov.uk/risk/images/risk-matrix.gif

There are broadly two types of investigation:

A simple investigation (for low potential incidents), normal undertaken by the

relevant line supervisor. This will look into the circumstances of the event, and try to

learn any lessons in order to prevent future occurrences. Usually the lessons learnt

will only be shared locally, and corrective action will not require major investment.

A higher level, more detailed investigation (where there was actual, or potential for,

serious outcome). This will typically involve line supervisors or line managers, health

and safety advisers and employee representatives, and will look for the immediate,

underlying and root causes. The lessons learnt will usually be shared across the

company, and possibly across the industry. The prevention of serious damage orcasualties will often justify significant expenditure and effort.







http://www.hse.gov.uk/pubns/priced/hsg245.pdf



http://www.hse.gov.uk/risk/images/risk-matrix.gif











1.8 - Basic Accident Investigation Process.

The following four sections are a text copy of the Four Steps to Incident Investigation

animation. This is for the benefit of those students who are studying offline and cannot

access the animation. You can skip the next four sections by using the buttons below.

1.9 - Basic Incident Investigation Process. Step 1: Gathering Information.

Step 1: Gathering the information.

Some of the information required to conduct the investigation must be taken from the

scene of the incident. The scene must be kept secure and undisturbed until the

investigation team are satisfied that they have obtained all evidence and facts they need,

including all photographs, sketches and measurements they may want to take.

Other information may be gathered from other sources such as:

Witness statements.

Risk assessments.

Permits to Work.

Safe Systems of Work (e.g. Operating procedures).

Maintenance records.

Training records.

Medical Records.

Photographs, CCTV. Computer print outs.

Log Book entries.

Audits, inspection reports.

The information gathering process should ensure that:

It explores all reasonable lines of enquiry and that the causes are not decided

beforehand (i.e. the investigation team need to have an open mind and not be

biased). It is carried out in a timely manner which means as soon as possible after the event.

The investigation is structured, setting out clearly what is known, what is not known,

and records the investigation.

Observational Techniques.

The investigators will need to have good observational techniques so that they can identify

what work practices are unsafe and need to be changed. For observation to be effective,

they will need to have knowledge of the workplace and procedures, be open minded, and

keep a record of observations.














The observers should:

Take time to observe the whole scene.

Look everywhere (look above, look below, look behind, look inside).

Be inquisitive and question employees to get their views and information on risks.

Interview Techniques.

Interviewing witnesses is a key part of an investigation. However, if poor technique is used

in the interview it can severely limit the usefulness of the information obtained.

Good interview technique includes:

Explaining the purpose of the interview, what will be done with the information, and

that the ultimate goal is not to blame a person, but to identify the root causes of the

incident and prevent further incidents. The interviewee may not reveal information if

they believe you will blame or persecute one of their colleagues.

Making sure your manner does not intimidate the witness or make them feel

uncomfortable.

Conduct the interview in familiar surroundings which are less intimidating.

Encourage witnesses to cooperate by speaking openly, with their own words.

Interviewing witnesses privately and separately to avoid them sharing their ownaccounts of the incident.

Providing a summary of what the witness said so that they can ensure that

everything has been understood correctly and that the interviewer has not

misinterpreted their account.

Essentially, you are seeking to gather all the information relating to the Material, the Task,

the Environment, the Personnel and the Management.














Figure 1. Accident Information.

1.10 - Basic Incident Investigation Process. Step 2: Analysing the Information.

An analysis involves:

Examining all the facts.

Determining what happened.

And why it happened.

All the detailed information gathered should be assembled and examined to identify what

information is relevant and what information is missing. The information gathering and

analysis are actually carried out at the same time. As the analysis progresses, further lines

of enquiry requiring additional information will develop. New evidence raises further

questions, which require further information gathering.

The analysis should be conducted with employee or trade union health and safety

representatives and other experts or specialists, as appropriate. This team approach canoften be highly productive in enabling all the relevant causal factors to emerge. Those with

expert knowledge or experience will have a different view point and will be able to ask

questions that other team member will not think of.

It is only by identifying all causes, and the root causes in particular, that you can learn from

past failures and prevent future repetitions.

There are many methods of analysing the information gathered in an investigation to find

the immediate and root causes and it is for you to choose whichever method suits you best.One such analytical tool is the "Why" tree which we illustrate below.














It is important to understand the difference between Immediate, Underlying, and Root

causes.

Immediate causes are the unsafe acts and conditions that occurred at the time and place of

the accident. These are the most obvious reasons why the incident occurred. For example:

a missing blank caused flammable gas to escape, or overspeeding caused a road tanker to

overturn.

Underlying causes are the less obvious system or organisation reasons for the incident.

Using the above examples: the manager of an installation was not aware that the blank was

missing because he had not been informed by the previous shift, or the delivery schedule

included an extra delivery that could not be reasonably be delivered that day, and therefore

the driver was speeding.

Root causes are much deeper and rooted in problems within management, planning, and

organisational culture. These root causes lead to the situations, events and behaviours that

lead to the incident occurring. These are the true cause of the incident. Again using the two

examples above, production pressures may have caused supervisors to take shortcuts in

the permit to work system, resulting in gas being pumped into a pipe without a blank fitted.

Similarly, poor scheduling or pay policies may encourage a driver to speed.

A common definition for a root cause is "the most basic cause (orcauses) that can reasonably be identified that management has control

to fix and, when fixed, will prevent (or significantly reduce the likelihood

of) the problem's recurrence."

How Do we Identify the True Root Cause?

As we said above, there is a variety of different methods to identify Root Causes but one of

the easiest and most common methods is called the '5 Whys' approach, commonly knownas a 'Why Tree'. It does require experience and common sense to be used effectively and

get to the true root cause. As a general rule if you identify that an individual person is at

fault, then you have not reached the true root cause.

Let us summarise the above examples, and hopefully you will understand the difference

between the immediate, underlying, and root causes.

Missing Blank.

1. Top event: An explosion occurred. Why?

2. Immediate cause: Because flammable gas was pumped into a pipe with a














missing blank, allowing it to escape and reach an ignition source. Why?

3. Underlying cause: Because the control room operator was not aware the

blank had been removed. Why?

4. Underlying cause: Because this information was on an open permit towork and this had not been communicated at shift handover. Why?

5. Root cause: Production pressures are leading to control room staff taking

shortcuts in the permit to work and handover procedures, resulting in

poor communication.

Overturned Road Tanker.

1. Top event: A road tanker overturns while going around a sharp bend.Why?

2. Immediate cause: The road tanker was travelling too fast. Why?

3. Underlying cause: The road tanker driver felt under pressure to deliver his

load on time. Why?

4. Underlying cause: The delivery schedule added in an extra delivery at the

last minute which cannot be delivered without taking shortcuts or

speeding. Why?

5. Root cause: There are problems in scheduling and priority is given to on-

time deliveries instead of road safety.














Figure 1. Example of a 'Why Tree'.

1.11 - 'Why Tree' Example.













1.11 - 'Why Tree' Example.

Figure 1. Another 'Why Tree' example.

By asking why during the investigation process, the investigation team can build up a clear

picture of where the failures occurred.

1.12 - Basic Incident Investigation Process. Step 3: Identifying Suitable Risk Control

Measures.

The analysis will have identified a number of risk control measures that either failed or that

could have interrupted the chain of events leading to the accident or incident, if they had

been in place. You should now draw up a list of all the alternative measures to prevent this,

or similar, adverse events.

Some of these measures will be more difficult to implement than others (for example:

those which correct root causes, which reflect management system failures), but this must

not influence their listing as possible risk control measures. The time to consider these

limitations is later when choosing and prioritising which measures to implement.

Evaluate each of the possible risk control measures on the basis of their ability to prevent

recurrences and whether or not they can be successfully implemented.

In deciding which risk control measures to recommend and their priority, you should













1.12 - Basic Incident Investigation Process. Step 3: Identifying Suitable Risk Control

Measures.

choose measures in the following order, where possible:

1. Measures which eliminate the risk (e.g. use 'inherently safe' solutions such as a

water-based product rather than a hydrocarbon-based solvent).

2. Measures which combat the risk at source via engineering or physical solutions (e.g.

provision of guarding).

3. Measures which minimise the risk by relying on human behaviour (e.g. safe working

procedures, the use of personal protective equipment and training).

In general terms, measures that rely on engineering risk control measures are more reliable

than those that rely on people. The above priorities are a philosophy loosely called the

'hierarchy of control'.1.13 - Basic Incident Investigation Process. Step 4: The Action Plan and its

Implementation.

At this stage in the investigation senior management, who have the authority to make

decisions and act on the recommendations of the investigation team, should be involved.

An action plan for the implementation of additional or improved risk control measures is

the desired outcome of a thorough investigation. The action plan should have 'SMART'

objectives (i.e. Specific, Measurable, Agreed, and Realistic, with Timescales).

Risk control measures will be implemented according to priority. In deciding your priorities

you should be guided by the magnitude of the risk. Ask yourself 'What is essential to

securing the health and safety of the workforce today? What cannot be left until another

day? How high is the risk to employees if this risk control measure is not implemented

immediately?' If the risk is high, you should act immediately.

Risk control improvements will, no doubt, be subject to financial constraints. But failing to

put in place measures to control serious and imminent risks is totally unacceptable. Youmust either reduce the risks to an acceptable level, or stop the work.

For those risks that are not high and immediate, the risk control measures should be put

into your action plan in order of priority. Each risk control measure should be assigned a

timescale and a person made responsible for its implementation.

Progress on the action plan should be regularly reviewed. Any significant departures from

the plan should be explained and risk control measures rescheduled, if appropriate.

Employees and their representatives should be kept fully informed of the contents of therisk control action plan and progress with its implementation.













1.13 - Basic Incident Investigation Process. Step 4: The Action Plan and its

Implementation.

Figure 1. Example of a blank safety action plan document.

1.14 - Types of Causes or Failures.

We can categorise most causes of incidents as the following types of failure:

Management or system failures.

Cultural failures.

Technical or process failures.

Management or System Failures.

These can include:

Lack of commitment by management to safety.













1.14 - Types of Causes or Failures.

Lack of supervision.

Inadequate resources provided (manpower, financial, equipment etc.).

Failure to risk assess.

Mixed messages (actions and behaviour contradict verbal commitment to safety).

Lack of procedures, or procedures not implemented, maintained or followed.

Equipment not maintained adequately due to lack of time, resources or management

oversight.

Cultural Failures.

These include causes rooted in the organisation's safety culture.

Safety Culture can be defined as: "The product of individual and group values , attitudes , perceptions , competencies , and patterns of behaviour that determine the commitment to,

and the style and proficiency of, an organisation's health and safety management".

Lack of safe working practices tolerated and condoned by all.

Previous near-misses not reported as not seen as important.

Blame culture.

Poor communication or working relationships between departments or between

client and contractors.

Complacency amongst workforce.

Technical or Process Failures.

These include any equipment malfunction, for example:

Emergency shutdown devices do not activate.

Gas detectors fail to detect the gas.

Blowout preventer buckles under pressure.

Automatic fire doors fail to close.

Pressure relief valve fails.

Overfill alarms do not send signal to control room.

1.15 - Learning the Lessons.

The lessons learned from incidents all contribute to the growing knowledge and experience

of the individuals, organisation, and industry, and this can help in avoiding repetition of

such events. This is because the consequences of accidents in the oil and gas industry can

be particularly catastrophic causing many fatalities (for example, Bhopal and Piper Alpha),

massive damage (for example, Buncefield), and major pollution (for example, Deepwater













1.15 - Learning the Lessons.

Horizon).

You will learn more about the above incidents in Element 2 of this course.

Figure 1. The enormous size of the Deepwater Horizon spill in the Gulf of Mexico.

Acquiring knowledge and experience from incidents should be a structured process,

whether it is a minor or major incident. It is important that lessons learned come from a

basic understanding of the root causes to develop a safety culture and systems that are

capable of avoiding major catastrophes.

Learning lessons from an incident can benefit two main areas:

Local and organisational learning i.e. the people directly involved, and others

employed in the organisation who may use similar equipment and operate similar

processes or systems. Wider learning, for example across industry, professions, and amongst regulators.

1.16 - Learning Lessons Locally.

At the end of the investigation there needs to be a communication of the conclusions

arrived at from all of the information gathered and analysed. This includes the root causes,

underlying causes, and the recommendations to remedy these. It is important to

communicate these in such a way that it is understood by everyone, in a format that is

appropriate to the audience and hierarchical level. Sharing information across teams anddepartments can result in local improvements and changes to practices. It can also













1.16 - Learning Lessons Locally.

communicate lessons which can change attitudes and perceptions.

For particularly large organisations it can be difficult to decide what lessons are relevant to

share within our teams. Therefore sharing information should be a structured process

where each department decides if the information is relevant and how to communicate it.

Below is an example of a assessment process.

Figure 1. Incident Information Assessment Process.

1.17 - Learning Lessons More Widely.

Lessons learnt within one organisation can be disseminated widely throughout other

organisations by the publication of information in trade or specialised journals or

publications, or through websites. This allows professionals in other organisations to take

those lessons and present them to their colleagues and managers. One of the major lessons

that the oil and gas industry has had to learn over the past 20 years is that they need to

make sure they do not focus on general health and safety at the expense of process safety

which is capable of causing major incidents.

Regulators and enforcing authorities are also capable of learning lessons. One of the root

causes of some major oil and gas disasters has been poor or ineffective regulation and

oversight. This has led to the development of safety case and safety report legislation insome countries (we will learn more about this later in this Element).













Quiz - Incident Management Cycle.

Please drag the elements of the 'Incident Management Cycle' to their corresponding areas.













Question 1.

Which of these parties may take part in an accident investigation?

Question 2.

Put the steps of accident investigation into the correct order.

Question 3.

Is this the correct definition of a 'root cause'?

"T he most basic cause (or causes) that can reasonably be identified that

management has control to fix and, when fixed, will prevent (or

significantly reduce the likelihood of) the problem's recurrence".

1.18 - Example Exam Questions on Learning from Incidents.

Here is a selection of past exam questions on learning from incidents. There is no guarantee

that these questions will ever be asked again, but these will give you a good idea of the

types of questions you could be asked.

1. Many major oil and gas incidents have occurred in recent years, e.g. Piper Alpha, Texas

City, Mumbai High.

(a) Outline reasons why such incidents should be investigated by employers. (4 marks

available).

(b) Identify parties, other than the employer, who may want to investigate these types of

incident. (4 marks available).

2. Identify the information that might be included on a checklist for an investigation

ollowing an accident. (8 marks available).

1.19 - Summary.

The learning outcome for this section was:

1.0 - Explain the purpose of and procedures for investigating incidents and how lessons

learnt can be used to improve Health & Safety in the oil & gas industry.

In summary we have learnt:

Why investigating incidents is important.

About the 4 Step process recommended by the HSE for investigating incidents:

1. Gather information.

2. Analyse information and determine immediate and root causes.













1.19 - Summary.

3. Identify suitable risk control measures.

4. Develop an action plan and implement.

The information and techniques required for an effective investigation.

The difference between immediate, underlying, and root causes.

The difference between management, cultural, and technical failures.

The importance of sharing lessons locally and more widely.

2.0 - Hazards Inherent in the Oil and Gas Industry.

The learning outcome for this section is:



In this section we will look at various hazardous definitions from the oil and gas industry so

that you have a greater understanding of hazardous situations and hazardous conditions.

In particular we will cover the following phenomena, along with a number of hazardous

gases and substances.

Flash Point.

Vapour Density. Vapour Pressure.

Flammable.

Highly Flammable.

Extremely Flammable.

Toxicity.

Skin Irritant.

Carcinogenic Properties.

Upper Flammable Limit.

Lower Flammable Limit.













2.0 - Hazards Inherent in the Oil and Gas Industry.

Figure 1. Photo of a platform fire. 2.1 - Flash Point.

This is the lowest temperature at which the vapour above a volatile liquid forms a

combustible mixture with air. At the flash point the application of a naked flame gives a

momentary flash rather than sustained combustion, for which the temperature is too low.

The flash point is an indication of how easy a chemical may burn. Liquids with low flash

points pose the greatest danger because the flash point will be below the ambient

temperature of most workplaces. The higher the flash point, the less likely it is to burn.

Figure 1. Example of a flammable warning symbol.

2.2 - Vapour Density.

This defines the density of a vapour in relation to air. The vapours of flammable liquids can

ignite if fire or sparks are present. The vapour density would indicate whether a vapour is

denser (greater than one) or less dense (less than one) than air.

The density has implications during storage and personnel safety. If a container can release

a dense gas, its vapour could sink and, if flammable, collect until it is at a concentration

sufficient for ignition. Even if not flammable, it could collect in the lower floor or level of a

confined space and displace oxygen, possibly presenting an asphyxiation hazard to













2.2 - Vapour Density.

individuals entering the lower part of that space.

In summary, dense gases and vapours will sink, causing potential fire and asphyxiation

hazards. Lighter gases and vapours will rise, dispersing quickly but also possibly

accumulating at a higher level.

Figure 1. Illustration of CO2 gas sinking to a low level and extinguishing a candle.

2.3 - Vapour Pressure.

The definition of vapour pressure is difficult to understand. It is the pressure of a vapour in

thermodynamic equilibrium with its condensed phases in a closed system. All liquids and

solids have a tendency to evaporate into a gaseous form, and all gases have a tendency to

condense back to their liquid or solid form.

This can be a difficult concept to grasp, so we will try to provide a better explanation.

The boiling point of a liquid is the temperature at which the vapour pressure of the liquid

equals the atmospheric pressure. To make it easier to understand, think of 'atmospheric

pressure' as the air in the world pushing against a certain person or object. The vapour

pressure is the pressure exerted by the gas (evaporated liquid) back against the














atmosphere. It is a battle of the two pressures. The liquid wants to evaporate and therefore

exerts pressure against the atmosphere. The atmosphere exerts pressure back. If the

vapour pressure is greater than the atmospheric pressure then the liquid will evaporate. If

not, then little or no evaporation can occur.

Exposure to higher temperatures increases the vapour pressure of a liquid. For example,

water boils at 100°C at an atmospheric pressure of 1 atm (atm is short for atmosphere, one

of the units for pressure). If the atmospheric pressure was lower than 1 atm, it would be

easier for the water to boil and evaporate, because there would be less pressure for it to

fight against. Therefore the boiling point would be lower, which means that water would

boil at a temperature lower than 100°C (water would boil more easily). If the pressure was

greater than 1 atm, then a higher temperature would be needed to boil the water, because

the vapour would need to have a higher pressure to fight against the atmospheric pressure.This means that you would need to heat the water to a temperature greater than 100°C in

order for it to boil.

All liquids have an inherent vapour pressure at normal atmospheric pressure and

temperature. Some are higher, some are lower.

This means that the greater the vapour pressure, the easier it is for a liquid to evaporate.

This is particularly relevant when the vapours are flammable or toxic, as a higher vapour

pressure will increase the amount of evaporation of these hazardous liquids, resulting inincreased fire risks.

A substance with a high vapour pressure at normal temperatures is often referred to as

'volatile'. For example, LPG and LNG.

Consideration also has to be given to mixtures of substances with different vapour

pressures.














Figure 1. Drawing illustrating vapour pressure and the effect of mixing substances.

2.4 - Flammable.

Flammable liquids are defined as those with a flashpoint below 55°C.

In the United Kingdom, flammable liquids are categorised according to their level of

flammability:

Flammable liquids which have a flash point between 21°C and 55°C.

Highly flammable liquids have a flash point below 21°C

Extremely flammable liquids and gases have a flash point below 0°C and a boiling

point below 35°C

At an international level there are differences in the definition of flammable liquids, with

some variation in the defining temperatures. However, what remains the same is that the

lower the flash point and boiling point, the more hazardous the flammable liquid.

For example, in the United States, flammable liquids are defined as those with a flash point

below 38°C.

For exam purposes, you should remember the U.K. definition.













2.4 - Flammable.

Figure 1. Flammable liquid burning.

2.5 - Flammable Limits.

The Fire Triangle.The fire triangle or combustion triangle is a simple model for understanding the necessary

ingredients for most fires. The triangle illustrates the three elements a fire needs to ignite:

Heat or energy in the form of a spark.

Fuel.

An oxidising agent (usually oxygen).

A fire naturally occurs when the elements are present and combined in the right mixture.

This means that:

There needs to be sufficient heat or energy to ignite the fuel.

The mixture of oxygen and fuel has to be in the correct proportion to burn. There is a

limit to how much or how little oxygen you can introduce into an atmosphere

without extinguishing the fire.

These limits are called 'flammability limits'.














Figure 1. The Fire Triangle.

Upper Flammability Limit.

The upper flammable limit (UFL) gives the richest flammable mixture. Beyond this there is

too much vapour and not enough air for ignition to take place. We also refer to upper

explosive limits (UEL) where there is a possibility of an explosion.

Lower Flammability Limit.

The lower flammable limit (LFL) describes the leanest mixture that still sustains a flame, i.e.

the mixture with the smallest fraction of flammable gas. Below this there is too much air

and not enough vapour for ignition to take place. We also refer to lower explosive

limits (LEL) where there is a possibility of an explosion.














Figure 2. Flammable limits illustrated.

The risk of working in an atmosphere which is in between the lower and upper flammability

limits is that an ignition source (such as a spark from a metal tool, or electrical equipment)

can ignite the atmosphere causing an explosion and a fire.

2.6 - Toxicity.

Toxicity is the degree to which a substance is able to damage an exposed organism. Toxicity

can refer to the effect on a whole organism, such as an animal, bacterium, or plant, as well

as the effect on a substructure of the organism, such as a cell or an organ ( the liver for

example).

There are generally three types of toxic entities: chemical, biological and physical.

Toxicity can be measured by its effects on the target (organism, organ, tissue or cell).Because individuals typically have different levels of response to the same dose of a toxin,

effects to the human body can vary in time and outcome.

A central concept of toxicology is that effects are dose-dependent. Even water can lead to

water intoxication when taken in too high a dose.













2.6 - Toxicity.

Figure 1. Toxic hazard symbol.

2.7 - Skin Irritant.

Irritation is a state of inflammation or painful reaction to an allergy or cell-lining damage. A

stimulus or agent which induces the state of irritation is called an irritant. Irritants are

typically thought of as chemical agents but mechanical (for example fibreglass), thermal

(heat), and radioactive stimuli (for example ultraviolet light or ionising radiation) can also

be irritants.

Chronic irritation is a medical term signifying that afflictive health conditions have been

present for a long time (chronic implies a low dose over a long period of time). There are

many disorders that can cause chronic irritation. The majority involves the skin, eyes and

lungs.

In higher organisms, an allergic response may be the cause of irritation.













2.7 - Skin Irritant.

Figure 1. Hazard symbol for irritant substances.

2.8 - Carcinogenic Properties.

A carcinogen is any substance, radionuclide or radiation, which is an agent directly involvedin causing cancer. Several radioactive substances are considered carcinogens, but their

carcinogenic activity is caused by the radiation which they emit (for example, gamma rays

and alpha particles). Other common examples of carcinogens are inhaled asbestos, certain

dioxins, and tobacco smoke.

Cancer is a disease in which damaged cells do not undergo programmed cell death.

Carcinogens may increase the risk of cancer by altering cellular metabolism or damaging

DNA directly in cells, which interferes with biological processes, and induces uncontrolled,

malignant division, ultimately leading to the formation of tumours.

Figure 1. Hazard symbol for carcinogens.

2.9 - Properties and Hazards of Gases: Hydrogen.

Figure 1. Hydrogen as represented on the periodic table.

Hydrogen is a colourless, odourless, tasteless, flammable and non-toxic gas. It is the lightest

of all gases.

Hazardous Properties RisksHydrogen is flammable over a wide

range of concentrations (LFL 4% - HFL

75%).

High risk of fire and explosion, even

with the smallest and largest of leaks.

The ignition energy for hydrogen isvery low. This means it can ignite even

with very low energy sparks.

Incredibly easy to ignite.













2.9 - Properties and Hazards of Gases: Hydrogen.

A single volume of liquid hydrogen

expands to about 850 volumes of gas

at standard temperature and pressure

when vaporised.

This means that a hydrogen leak can

rapidly become a large flammable

vapour cloud.

Hydrogen is able to reduce the

performance of some containment

and piping materials, such as carbon

steel as a result of a phenomenon

called 'hydrogen embrittlement'

where hydrogen atoms diffuse into

the metal.

Metals can become brittle and break

easily, causing loss of containment.

This diffusion of atoms also means it

has a tendency to easily leak out ofvessels and pipes.

Tendency to leak easily and cause

flammable atmospheres.

Liquid hydrogen is extremely cold. Can cause frostbite and cold burns.

The cold also contributes to metal

embrittlement. If a hot metal is

exposed to liquid hydrogen then it can

suffer from thermal shock and

fracture.

Can be an asphyxiant in its pure,oxygen free form. A build-up of hydrogen can asphyxiatepeople.

A hydrogen fire is extremely hot and

almost invisible.

If you cannot see it you may

accidentally come into contact with it.

Table 1. The hazardous properties and risks of Hydrogen.

2.10 - Properties and Hazards of Gases: Methane.

Figure 1. Chemical formula of methane.

Methane is a naturally occurring, flammable gas that is colourless and odourless. Methane

is the primary component of natural gas. 97% (by volume) of natural gas is methane.

Methane comes from a number of different sources. Underground deposits of natural gasare the primary source of methane. Methane is also trapped in pockets near coal deposits.

Methane can also be stored in liquid form.













2.10 - Properties and Hazards of Gases: Methane.

Hazardous Properties RisksMethane's flammability range is

between LEL 5% and UEL 15%.

High risk of fire and explosion when in

presence of oxygen.

Colourless and odourless. Cannot be

seen or smelled.

Difficult to detect by humans without

detection equipment.

Displaces the surrounding oxygen. Can be an asphyxiation risk.

Methane reacts violently with

oxidisers, halogens and halogen

containing compounds.

Can spontaneously ignite or explode if

it comes into contact with

incompatible materials.

Leak from a refrigerated stored vessel

is heavier than air.

Leaks will initially create a pool of

flammable liquid and gas.

Methane at ambient temperature islighter than air.

When the methane reaches ambienttemperature it can form a flammable

vapour cloud.

Table 1. The hazardous properties and risks of methane.

2.11 - Properties and Hazards of Gases: Liquid Petroleum Gas (LPG).

Produced from petroleum, LPG is a mixture of gases (propane and butane). Its uses include

fuel for cooking, heating and vehicles, and as a refrigerant. It is colourless and odourless,

and has an odorising agent added for leak detection purposes.

Hazardous Properties RisksFlammable between LEL 2% and UEL

10%.

Can cause fire and explosions in the

presence of oxygen, even at very low

concentrations.

Twice as heavy as air. Will sink to the lowest possible level

and accumulate. This could be in

basements, cellars, pits, drains, whereit can find an ignition source. There is

an obvious fire risk in underground

confined space work.

Extremely cold when stored under

pressure.

Can cause severe cold burns due to

the low temperature and rapid

vaporisation. It can also cool

equipment to the point where

touching the equipment can also

cause cold burns.

LPG is stored under pressure. On Can quickly create a flammable













2.11 - Properties and Hazards of Gases: Liquid Petroleum Gas (LPG).

release it reverts to its gaseous state,

the gas becoming about 250 times its

stored liquid volume.

vapour cloud.

Vapour and air mixtures arising fromleakages travel some distance from

the point of escape.

When ignited the flame can travelback to the source of the leak.

At very high concentrations when

mixed with air, vapour is an

anaesthetic and subsequently an

asphyxiant by diluting the available

oxygen.

Asphyxiant risk.

Colourless and odourless (without the

odorising additive).

Difficult for humans to see or smell,

which is why an odorising additive isadded.

Empty LPG vessels usually contain

some residual LPG vapours.

Even empty vessels are a fire and

explosion risk.

Table 1. The hazardous properties and risks of LPG.

Figure 1. Warning sign for LPG.

2.12 - Properties and Hazards of Gases: Liquefied Natural Gas (LNG).

LNG is liquefied natural gas. It originates from underground natural oil and gas reservoirs,













2.12 - Properties and Hazards of Gases: Liquefied Natural Gas (LNG).

often discovered through drilling and exploration operations. LNG is principally used for

transporting natural gas to markets, where it is regasified and distributed as pipeline

natural gas.

Hazardous Properties RisksHas a flammability range of LEL 5% to

UEL 15%.

Highly flammable and explosive in the

correct air to gas ratio.

The gas is a liquid because it is stored

at very low temperature (-162C), at

around atmospheric pressure.

Because of its temperature LNG can

cause cold burns.

When released at its cold

temperature will create a pool of

liquid and gas.

Can create a pool fire which is

extremely difficult to extinguish.

Usually this is left to burn until all of

the fuel is burnt.

Once it reaches ambient temperature

the liquid rapidly expands to 600

times the volume of its liquid form.

Can create a flammable vapour cloud.

Table 1. The hazardous properties and risks of Liquified Natural Gas.

Figure 1. A LNG pool fire.

2.13 - Properties and Hazards of Gases: Nitrogen.














Figure 1. Nitrogen on the periodic table.

Nitrogen is a nontoxic, odourless, colourless, tasteless and non-flammable gas. 78% (by

volume) of the air we breathe is nitrogen. Oxygen constitutes approximately 21% of the air.

Nitrogen weighs approximately the same as air, therefore it does not tend to sink or rise.

Its ability to displace oxygen in the air is the reason it is often used as an inerting gas to

control flammability risks.

Hazardous Properties RisksWill displace the oxygen in the air. Will cause asphyxiation when the

concentration of oxygen drops below19.5%.

Odourless, colourless, and tasteless. Difficult for humans to detect without

the use of detection equipment.

When stored under pressure nitrogen

is an extremely cold liquid (-200oC).

Contact with this liquid or the cold

vapours can cause severe frostbite (it

is used by the medical profession for

destroying warts).

When inhaled at high pressures itbegins to act as an anaesthetic.

Has an anaesthetic effect on the bodyand nervous system. For example,

nitrogen narcosis when scuba-diving

below 30m.

Nitrogen dissolves in the bloodstream

and body fats.

Rapid decompression of scuba-divers

can lead to decompression sickness

and "the bends" where the nitrogen

bubbles form inside the bodily tissues.

Table 1. The hazardous properties and risks of nitrogen.














Figure 2. A jar of liquid nitrogen evaporating.

2.14 - Properties and Hazards of Gases: Hydrogen Sulphide (H2S).

Figure 1. Hydrogen sulphide hazard symbol.

Found in crude oil and gas, hydrogen sulphide is considered a broad-spectrum poison,

meaning that it can poison several different systems in the body, although the nervous

system and respiratory systems are most affected. Besides being highly toxic, H2S is a

flammable gas. It also causes irritation to the eyes, skin and mucous membranes. H2S is

commonly found in natural gas, biogas, and LPG.













2.14 - Properties and Hazards of Gases: Hydrogen Sulphide (H2S).

Hazardous Properties RisksHas a flammability range of LEL 4.3%

and UEL 46%.

Highly flammable and explosive in the

correct fuel to air ratio.

Highly toxic at extremely low

concentrations.

At concentrations of 800ppm 50% of

people will die within 5 minutes of

exposure. 1000ppm will cause instant

collapse and loss of breathing, even

with one single breath.

It is heavier than air and hence tends

to accumulate in low-lying areas.

Risk of death to anyone in a low-lying

space where H2S accumulates. Also a

fire and explosion risk if it finds an

ignition source.It has an extremely pungent odour

(rotten eggs) and highly corrosive.

Despite its odour, the corrosiveness

will rapidly destroy the body's sense

of smell. The corrosiveness can also

make metals brittle. Therefore,

employers need to take special

precautions when choosing

equipment if they may come into

contact with H2S.

Table 1. The hazardous properties and risks of Hydrogen Sulphide.

Figure 2. Workers working on plant containing H2S.

2.15 - Properties and Hazards of Gases: Oxygen.














Figure 1. Oxygen as represented on the periodic table.

The air we breathe contains about 21% oxygen (O2). Without oxygen we would die in amatter of minutes. However, oxygen can also be dangerous. The dangers are fire and

explosion. Oxygen behaves differently to air, compressed air, nitrogen and other inert

gases. It is very reactive. Pure oxygen, at high pressure, such as from a cylinder, can react

violently with common materials such as oil and grease. Oxygen is not flammable. But other

materials may catch fire spontaneously when in contact with pure oxygen. Nearly all

materials including textiles, rubber and even metals will burn vigorously in oxygen enriched

atmospheres.

A small increase in the oxygen level in the air to 23% (oxygen enrichment) can create adangerous situation. It becomes easier to start a fire, which will then burn hotter and more

fiercely than in normal air. It may be almost impossible to put the fire out. A leaking valve

or hose in a poorly ventilated room or confined space can quickly increase the oxygen

concentration to a dangerous level (for example the HMS Glasgow incident in 1976).

Figure 2. Example of how oxygen helps a fire burn faster and hotter.







http://news.bbc.co.uk/onthisday/hi/dates/stories/september/23/newsid_2528000/2528517.stm











Hazardous Properties RisksHighly reactive. Oxygen enriched atmospheres or pure

oxygen can cause spontaneous

burning of materials (particularly oils

and greases). All fires will burn hotter

and more fiercely in the presence of

oxygen.

Stored under pressure and at low

temperature.

Can cause cold burns.

Pure oxygen can be toxic to inhale.

Oxygen can also be toxic in high

pressure atmospheres.

Disrupts the central nervous system

and causes pulmonary difficulties. In

particular scuba divers and peoplebeing treated in hyperbaric chambers

are most at risk.

Table 1. The hazardous properties and risks of Oxygen.

2.16 - Properties, Hazards, and Control Measures of Additives: Antifoaming and Anti-

Wetting Agents.

Antifoaming Agents:

A defoamer or an antifoaming agent is a chemical additive that reduces and hinders the

formation of foam in industrial process liquids.

Generally a defoamer is insoluble in the foaming medium. An essential feature is a low

viscosity and a facility to spread rapidly on foamy surfaces. It tends to float on the surface

where it destabilises the foam. This causes the rupture of the air bubbles and the

breakdown of surface foam.

Foam (entrained and dissolved air that is present in coolants and processing liquids) may

cause various kinds of problems, including:

Reduction of pump efficiency (cavitation).

Reduced capacity of pumps and storage tanks.

Bacterial growth.

Dirt flotation and deposit formation.

Reduced effectiveness of the fluids in use.

Eventual downtime for cleaning.














Wetting Agents.

Antifoaming agents may be oil, powder, water or silicone based.

Figure 1. Defoamer in action.

Anti-Wetting Agents:

Water is often detrimental to materials when their surfaces become penetrated by

moisture. Metal surfaces can corrode and wood degrades. Anti-wetting agents (for

example, Teflon) place a waterproof barrier between the surface of the material and the

water (for example, sea water and rain). Such coatings are said to be 'hydrophobic' (water

repellent). Anti-wetting agents effectively offer good corrosion protection.














Wetting Agents.

Figur e 2. Example of 'phobic' coatings such as anti-wetting and self-cleaning.

Hazards and Controls.Antifoaming and anti-wetting agents are usually not hazardous. Prolonged exposure may

cause some skin irritation so it is sensible to wash your hands carefully after use. The

product's Material Safety Data Sheet will specify any particular hazards and the handling

precautions.

2.17 - Properties, Hazards, and Control Measures of Micro-Biocides.

Micro-biocides are used in the gas and oil industry to control the growth of bacteria and

prevent the formation of harmful by-products of their growth (such as H2S). A biocide is achemical substance or micro-organism.

They can be added to protect materials (typically liquids) against biological infestation and

growth. In refineries, for example, uses include the treatment of cooling water to remove

and prevent spores, fungi, legionella bacteria, and to prevent bacterial slime which

significantly reduces heat transfer in cooling systems, such as heat exchangers.

As a general rule they tend to be irritants and toxic when ingested. The use of chlorine, for

example, poses the risk of severe irritation of the skin, nose, throat and respiratory tract.

To control exposure to micro-biocides they should be stored safely and precautions taken













2.17 - Properties, Hazards, and Control Measures of Micro-Biocides.

to eliminate contact with the skin, eyes, and inhalation. These could include:

Choosing a safer form of micro-biocide. For example, using a granular form instead of

a powder or liquid.

Using safe handling methods such as automatic dispensers.

Adequate chemical resistant storage.

Suitable PPE such as appropriate gloves, and if necessary goggles, apron, and

respiratory protection.

Procedures for dealing with spillages and releases.

Material Safety Data Sheets (MSDS) should be consulted for the specific hazards and

control measures required for each type of biocide.

Figure 1. Example of chlorine cylinders stored securely.

2.18 - Properties, Hazards, and Control Measures of Corrosion Preventatives.

Corrosion of metal in the presence of water is a common problem across many industries.

The fact that most oil and gas production includes water and other corrosive substances

makes corrosion a pervasive issue across the industry.

These are additives which are used to delay or prevent the formation of corrosion within














vessels, pipelines and structures. These are often applied to the surfaces of metals, forming

a film which displaces water and other liquids from cracks to block out their corrosive

effect. Other products form a protective barrier to prevent liquids from coming into contact

with the metal.

The Material Safety Data Sheet (MSDS) should specify the relevant risk control measures.

The products are often irritants, such as alkyl amine corrosion inhibitors which can cause

severe skin, nose, throat and eye irritation. The controls will usually be similar as those for

micro-biocides i.e. safe storage, handling, and appropriate PPE.

Cathodic Protection.

Cathodic protection (CP) is another technique used to control the corrosion of a metalsurface by making it the cathode of an electrochemical cell. The simplest method to apply

CP is by connecting the metal to be protected with a piece of another more easily corroded

'sacrificial metal' to act as the anode of the electrochemical cell. The sacrificial metal then

corrodes instead of the protected metal.

Figure 1. A sacrificial anode is bolted to the hull of a boat.














Figure 2. An underground pipe with cathodic protection. 2.19 - Properties, Hazards, and Control Measures of Refrigerants.

A refrigerant is a substance used to provide cooling either as the working substance of a

refrigerator or by direct absorption of heat. Common refrigerants include ammonia, sulphur

dioxide, and propane.

They are liquified gases, and present minimal risk when they are contained within their

system. The risks increase when there is an escape or a release of the refrigerant. Health

risks include flammability, toxicity and cold burns. At high levels they can cause CentralNervous System depression and cardiac arrest. Vapours displace air and can cause

asphyxiation in confined spaces, particularly as the gases are heavier than air.

As usual, the Material Safety Data Sheet will contain information on the hazards from

exposure, toxicity, and exposure limits for the specific substance used.

Generally speaking, the hazards and risks associated with refrigerants are:

Hazardous Properties Risks













2.19 - Properties, Hazards, and Control Measures of Refrigerants.

Will displace oxygen in the

atmosphere.

Can cause asphyxiation.

May be flammable. Fire or explosion risk.

Refrigerant gases are heavier than air. Will collect in the low available space,creating an asphyxiation and/or fire

risk.

Combustion byproducts can be toxic. If involved in a fire the byproducts can

cause harm if inhaled.

Stored under cryogenic pressure. Cold burns, particularly to skin and

eyes if the worker comes into contact

with the refrigerant.

They have a high expansion rate when

they change from a liquid to a gas.

Can cause overpressure to vessels and

piping, possibly causing rupture. In the

event of a high pressure escape,

workers can be injured from ejected

material or components.

Table 1. The hazardous properties and risks of refrigerants.

The general control measures for controlling refrigerants include:

Ensuring maintenance and inspection procedures are in place to ensure leaks andloss of containment do not occur, and that faults are repaired when they are

identified.

Having procedures in place to deal with unexpected release of refrigerants, such as

emergency spillage procedures, recovery procedures, and equipment to contain the

release.

Confined Spaces precautions such as atmospheric testing before and during work,

and not working in a confined space if there is a risk of refrigerant release.

Having well ventilated areas and ventilation equipment to quickly dilute and disperse

concentrations of refrigerant.

Emergency procedures for evacuation if there is a large release, along with first aid

measures such as moving victims to fresh air and providing oxygen as necessary.

Medical assistance may be necessary.

2.20 - Properties, Hazards, and Control Measures of Water and Steam.

Water exists in three states: liquid, solid (ice) and gas (steam). It is used extensively in the

oil and gas industry processes.














Uses include:

Water:

Cooling. Lubrication (drilling muds).

Fire water source.

Steam:

Power turbines to generate electrical power, to drive pumps, compressors, fans and

other equipment.

Heating source (control rooms, tank coils and trace heating).

Hot Water and Steam.

Heated water produces steam. When released (intentionally or accidentally) it is generally

under very high pressure and extremely high temperature.

Steam most often refers to the visible white mist that condenses above boiling water as the

hot vapour mixes with the cooler air. This mist consists of tiny droplets of liquid water. Pure

steam emerges at the base of the spout of a steaming kettle where there is no visible

vapour. Pure steam is a transparent gas. At standard temperature and pressure, pure steam

(unmixed with air, but in equilibrium with liquid water) occupies about 1,600 times the

volume of an equal mass of liquid water.

Water and steam are used extensively in oil and gas processing. Hazards and control

measures include:

Burns from steam or hot water. The avoidance of contact is critical. Good

maintenance procedures are required to ensure systems are in good condition to

prevent leaks and releases. Valves will need to be isolated to prevent the flow of hot

water and steam if work is to be carried out on the system.

Corrosion of pipe work or equipment. This can lead to leaks and releases, or the

failure of load-bearing metal structures. As discussed previously, protective coatings

can be applied to steel components or sacrificial anodes can be fitted to provide

cathodic protection.

Water starvation leading to overheating of process equipment. This can be caused by

blockages of cooling water, possibly caused by ice or hydrate formation (plugs of ice

and hydrocarbons). Loss of water supply can also lead to overheating. High pressure injuries and amputation, especially from pressure jet cleaning. Safe

systems of work need to be put in place, including exclusion of unnecessary














personnel, and safety features on the cleaning equipment (such as a dead man's

switch).

Water hammer from condensed water in steam systems. This is usually prevented by

closely controlling the conditions within the system to minimise condensation, and

regularly draining the water.

Exothermic reaction when water reacts with volatile substances. This is prevented by

controlling the process and strictly separating water from volatile substances.

Legionella exposure, from poorly maintained cooling water systems. This is

prevented by good temperature control, chemical disinfection, maintenance and

testing for bacteria. Water must be regularly circulated to prevent it from stagnating,

especially if it is in the 20°C to 45°C temperature range.

Leptospira, which can be found in water which has its source in freshwater rivers or

lakes. It can be transmitted to humans via broken skin or through the mucousmembranes of the nose and eyes. Extreme cases can lead to Weil's Disease which

can be fatal. Good personal hygiene is crucial.

Stored under pressure, as in fire lines and steam water lines. An increase in pressure

within pipework and other components can cause a sudden and catastrophic release.

This may be caused by an increase in temperature (e.g. exposure to direct sunlight,

or overheating).

If steam is suddenly introduced to a cold pipe then it can cause thermal shock,

leading to damage to the pipe due to the uneven expansion of the metal. Metal

joints and flanges are especially vulnerable.

Figure 1. Diagram illustrating power generation from steam turbines.














Figure 2. Ultra high pressure jet cleaning.

Freezing Water and Ice.Water expands when it freezes, and this can result in the bursting of pipework and other

components within the system. Under certain conditions plugs of ice can form and these

can block pipes and pumps and prevent the closure of valves. In critical situations this can

have catastrophic effects.

An example of this is the Feyzin Disaster in France 1968. An operator was draining water

from a pressurised propane tank when a hydrate plug formed in the drain valve.

Consequently, he was unable to close the valve and a cloud of propane vapour escaped andexploded when it came into contact with a source of ignition.







http://en.wikipedia.org/wiki/Feyzin_disaster











Controls to prevent this include:

Lagging and insulating pipes which are at risk of being damaged by freezing water.

Fitting steam or electric trace lines, which prevent the pipe from freezing.

Draining unused components so they cannot freeze.

Figure 3. Example of pipe lagging.

Figure 4. Example of electrical trace heating.

Sea Water.

Sea water contains living organisms which can multiply and cause blockages such as in

filters and the heads of sprinkler systems. This can be avoided by regularly maintaining all

parts of the system to keep them free of blocks, including using additives to kill any

organisms which may be present.

2.21 - Properties, Hazards, and Control Measures of Mercaptans.

Mercaptans are a group of sulphur-containing organic chemical substances.

They smell like rotting cabbage. If mercaptans are in the air, even at low concentrations,













2.21 - Properties, Hazards, and Control Measures of Mercaptans.

they are very noticeable. Pulp mills are the chief source of mercaptans. They are found in

production process of petroleum products.

They are also used as an odorising agent in natural gas (LNG). The human body produces

them naturally during digestion of beer, garlic and some other foods.

The vapours of some mercaptans, if inhaled, may cause headaches, nausea, dizziness,

drowsiness and loss of consciousness. They may also be irritating to the eyes, respiratory

system and skin. They can also be flammable.

Where potentially harmful levels are present, suitable respiratory protection, gloves, eye

protection and coveralls should be worn.

The Milan Incident.

In 2004 near Milan, an empty mercaptan canister used by a natural gas distributor was

being returned to a supplier for refilling. The canister sprang a leak while in transit at a road

deliveries company in Sesto San Giovanni, a town just north of Milan, Italy. Gas was carried

by winds across the eastern half of the city of Milan, causing residents as far as 12km from

the canister to make thousands of calls that overwhelmed emergency services for four

hours, and risked hiding actual gas leaks.

2.22 - Properties, Hazards, and Control Measures of Drilling Muds.

Liquid drilling fluids are often called drilling 'muds'. This is because it often contains locally

sourced clays and has a brown mud colour. However, it is not mud taken directly from the

ground, it is a specially designed fluid.

On a drilling rig, mud is pumped from the mud 'pits' (storage tanks for the liquids) through

the drill string where it sprays out of nozzles on the drill bit, cleaning and cooling the drill bit

in the process. The mud then carries the crushed or cut rock ('cuttings') up the annular

space ('annulus') between the drill string and the sides of the hole being drilled, up throughthe surface casing, where it emerges back at the surface. Cuttings are then filtered out with

either a 'shale shaker' or similar technology, and the mud returns to the mud pits. The mud

pits let the drilled 'fines' (smaller particles) settle. The pits are also where the fluid is

treated by adding chemicals and other substances.

The returning mud can contain natural gases or other flammable materials which will

collect in and around the shale shaker and conveyor area, or in other work areas. Because

of the risk of a fire or an explosion if they ignite, special monitoring sensors and explosion-

proof certified equipment is commonly installed.

The mud is then pumped back down the hole and further recirculated. After testing, the














mud is treated periodically in the mud pits to ensure properties which optimise and

improve drilling efficiency and borehole stability.

Figure 1. Diagram of the flow of drilling mud and cuttings.














Figure 2. Typical drilling fluid system.

The Functions of Drilling Muds.

Control pressures within the wellbore.

Maintain wellbore stability (i.e. line the walls of the hole).

Keeping the drill bit cool, clean, and lubricate during drilling.

Carrying out drill cuttings.

Suspending the drill cuttings while drilling is paused and when the drilling assembly is

brought in and out of the hole.

Transmit hydraulic energy to the tools and bit.

Control corrosion to an acceptable level.

Facilitate the cementing and completion of the oil and gas well.

Types of drilling fluids include water based, oil based and synthetic. Water based mud is the

most frequently used.

Water Based Mud.

This is a combination of clay and other additives blended with water to make a thick fluid.

The more additives in the water, the thicker the mud will be. The fluid is normally made

from indigenous clays although some additives may be brought in from specialist suppliers.

The additives alter the properties of the mud, making it more fluid and free-flowing when it

is pumped into the system, and semi-solid when the pumping stops.

Oil Based Mud.

These have oil, usually diesel oil, as their base fluid. The advantages oil based muds bring to

the drilling process include:

Increased lubrication of the drill shaft.

Greater cleaning ability.

They allow for higher working temperatures to be used without adverse effects. However,

due to the presence of oil there are environmental considerations to be taken into account.

Synthetic Based Mud.

These muds have the properties of oil based muds but have the advantage of being lesstoxic as their base is made from synthetic oil.














Hazards.

The hazards and risks include:

The possible presence of low-specific activity (LSA) scale and sludge (which we will

study in the following section) which can expose workers to radiation.

Chemical hazards which can affect workers depending on the route of exposure.

o Skin contact: this usually affects the hands and arms. This can cause skin

irritation and dermatitis. Regular exposure to diesel in oil based muds can be

carcinogenic in the long-term. Workers should attempt to minimise manual

handling of the chemicals, and wear personal protective equipment such as

overalls and gloves.

o Inhalation: muds can create vapours, aerosols, and emit dusts into the air.These are contaminated with chemicals, hydrocarbons, and possibly LSA

substances. These can be neurotoxic and cause headaches, nausea, dizziness,

fatigue, loss of coordination, problems with attention and memory, and

narcosis. The presence of benzene in the diesel can be carcinogenic.

o Ingestion: muds are rarely ingested, but are obviously toxic if swallowed. Good

personal hygiene is essential. Workers should change clothing and wash before

eating, drinking, or smoking.

Control Measures.

Depending on the circumstances, control measures will include:

Engineering measures:

o Maintaining high levels of ventilation to keep airborne concentrations and

exposures to an acceptable level.

o Enclose the drilling fluid systems to reduce emissions into the air.

o

Use bulk handling systems to eliminate the need to handle the fluids manually.o Use of sensors inside the fluid tanks to monitor levels and carry out other

measurements, instead of having to open the tank and visually inspect them.

Administrative controls:

o Work overalls and clothing should be cleaned regularly and thoroughly to

remove all traces of drill mud contamination. Dirty clothing is a regular source

of skin irritation.

o Regular washing and moisturing of the skin. This will remove contaminants,

and using skin moisturisers will keep the skin hydrated and healthy. The use of

barrier creams can also provide a barrier between the skin and low levelexposure to fluids.

o Job rotation can reduce the exposure of workers to drilling muds by reducing














the length of time they are exposed to the hazard. While this will expose more

people, the overall exposures of each person will be much lower.

o Health surveillance programmes are necessary to monitor the condition of

employees' skin and their pulmonary function.

o Deliver training and raise awareness of the hazards and the controls to be

followed. The information on Material Safety Data Sheets should be

communicated to all relevant personnel. This will include the hygiene and PPE

requirements to be followed.

o Emergency spillage procedures so that in the event of an accidental release

there is a method of cleaning and collecting the fluids while minimising

exposure.

Personal Protective Equipment:

o The use of protective clothing is advised to prevent direct contact withchemicals. PPE may include chemical splash goggles, appropriate chemical-

resistant impermeable gloves, rubber boots, and coveralls.

o If ventilation is not adequate it is recommended that goggles and self-

contained respirators are worn at all times. Respiratory protective equipment

(RPE) is considered to be a last resort. RPE should only be considered when

exposure cannot be adequately reduced by other means. It is vital that the RPE

selected is adequate and suitable for the purpose. It should reduce exposure to

as low as reasonably practicable, and in any case to below any applicable

occupational exposure limit or other control limit. To make sure that theselected RPE provides adequate protection for individual wearers, fit testing of

RPE including full-face masks, half-face masks and disposable masks is strongly

recommended. This will help to ensure that inadequately fitting face masks are

not selected.

2.23 - Properties, Hazards and Control Measures of Sludges (including LSA material).

During the drilling process, Naturally Occurring Radioactive Material (NORM) flows with the

oil, gas, and water mixture, and accumulates in scale, sludge, and scrapings. These NORMsinclude:

Uranium.

Thorium.

Radium.

Lead 210.

Oil and gas were created in the Earth's crust by the decay of sea life in ancient seas and are,

therefore, often found in aquifers which contain salt water (brine). Various minerals, as wellas radioactive elements, are also dissolved in the brine and these separate out and form














wastes at the surface. These include:

Mineral scales inside pipes.

Sludges.

Contaminated equipment or components.

Water.

The process of hydrocarbon extraction exposes the environment and workers to the

radioactive elements contained in the sludges. As such, they are classified as hazardous.

They can be found in the following locations:

On the drill string.

Inside vessels and tanks.

Inside filters.

In coolers where tubes might be coated with sludge.

Hazards.

Sludges are a mixture of liquid and suspended material, and therefore present a range of

hazards:

Skin irritation, and possibly dermatitis. Inhalation of the fumes or dusts from dried sludges.

Ingestion, through poor hygiene practices such as not washing, not cleaning up,

eating at work site).

Exposure to radioactive substances and carcinogens.

The main hazard of exposure to ionising radiation from LSA materials is that of the

inhalation and ingestion of radionuclides, especially of dust and fumes. Employees are at a

higher risk of significant exposure to ionising radiation if they work with dusty processes

unless adequate control measures have been put in place to prevent the inhalation of dust.

Employees may be exposed, although to a lesser extent, to direct radiation where there is

bulk storage of the material. They may also be exposed to external radiation if they are

involved in cleaning operations or the dismantling of equipment which contains scale from

oil and gas extractions.

Control Measures.

Employers should put in place controls to ensure that the risk of exposure to ionisingradiation is reduced 'so far as is reasonably practicable'. The use of PPE may be used only as

a last resort after all other control measures have been considered. Engineering controls














and the implementation of safe systems of work should take priority, and they include:

The provision of ventilation equipment to contain dusts and fumes.

The use of wet methods of working and good housekeeping to reduce the amount of

dust in the atmosphere.

Having equipment in place to collect sludge instead of using manual means.

Diluting sludge with water.

The use of permit-to-work systems. especially if the concentrations of dust or fumes

reach a level where only designated persons are allowed to work under the

restrictions of written safe system of work.

The provision of training and awareness programmes.

The provision of a health surveillance programme to monitor the health of

employees. Good supervision to ensure that everyone follows the necessary control measures.

Good hygiene practices, including washing before eating, drinking, or smoking, and

keeping work clothes clean.

The use of respiratory protective equipment specifically chosen to protect against

exposure to airborne radioactivity.














Figure 1. Photo of an employee in full PPE following a tank sludge cleaning operation.

Question 4.

Is the below statement true or false?

The higher the flash point, the greater the potential fire hazard.

Question 5.

Select the correct missing word to complete the below statement.

____ designates liquids with a flash point below 21°C.

Question 6.

Select the correct missing word to complete the below statement.

When Nitrogen concentrations increase (e.g. when purging equipment) and the oxygenlevels drop below _____, rapid suffocation can occur.













2.24 - Example Exam Questions on Hazards Inherent to the Oil and Gas Industry.

Here is a small selection of past exam questions on recent sections. It is unlikely that you

will be asked these questions at your exam. But you may be asked similar questions, and

therefore this is an opportunity for you to familiarise yourself with types of questions

NEBOSH ask at Certificate level.

1.

(a) Outline the term Flash Point. (3)

(b) Identify the Hazards associated with LNG. (4)

2. Give the meaning of the following terms:

(a) upper flammable limit (UFL); (2)

(b) lower flammable limit (LFL); (2)

(c) flashpoint; (2)

(d) Highly flammable liquids. (2)

3. Following preparation of a vessel for maintenance within an oil and gas installation a low

specific activity (LSA) radioactive sludge was encountered.

(a) Identify hazards associated with the sludge. (2)

(b) Outline control measures to reduce the risk to workers exposed to the sludge. (4)

(c) Identify TWO other pieces of workplace equipment where the sludge may be found. (2)

4.

(a) Identify properties of hydrogen. (4)

(b) Outline hazards associated with hydrogen. (4)

5.

(a) Identify properties of nitrogen. (4)

(b) Outline hazards associated with nitrogen. (4)

5.













2.24 - Example Exam Questions on Hazards Inherent to the Oil and Gas Industry.

(a) Identify properties of Hydrogen Sulphide. (4)

(b) Outline hazards associated with Hydrogen Sulphide. (4)

6.

(a) Identify properties of Methane. (4)

(b) Outline hazards associated with Methane. (4)

7.

(a) Identify properties of LPG. (4)

(b) Outline hazards associated with LPG. (4)













2.25 - Summary.




In this section we have learnt:

About various physical properties such as flash point, vapour density, vapour

pressure and flammability limits etc.

About the hazards and risks of various hazardous gases and substances such as LPG,

LNG, methane, hydrogen, hydrogen sulphide, mercaptans, water, drilling mud, low

specific activity sludge etc.

About related control measures for the above hazards.

3.0 - Risk Management Techniques Used in the Oil and Gas Industries.



In this section we will provide an overview of risk management techniques. In particular we

will discuss:

The purposes and uses of risk assessment techniques.

Qualitative and quantitative techniques.

How risk management tools are applied in process safety risk identification and

assessment.

How they are applied in project phases from concept, design and start-up.

The concept of 'as low as is reasonably practicable'.

The management of major incident risks.

Industry related process safety standards, inherent safe and risk based design

concepts, engineering codes and good practice. The concept of hazard realisation.

The concept of risk control using barrier models.

The use of modelling for risk identification, such as thermal radiation output and

blast zones.

3.1 - The Purposes and Use of Risk Assessment Techniques.

Employers in each workplace have a general duty to ensure the safety and health of

workers in every aspect related to their work. The purpose of carrying out a risk assessmentis to enable the employer to introduce control measures necessary for the safety and














health protection of workers.

Whilst the purpose of risk assessment includes the prevention of occupational risks, and

this should always be goal, it will not always be achievable in practice. Where elimination of

risks is not possible, the risks should be reduced and the residual risk controlled. At a later

stage, as part of a review programme, such residual risk will be reassessed and the

possibility of elimination of the risk, perhaps in the light of new knowledge, can be

reconsidered. In the oil and gas industry it will be necessary to identify risks related to

plant, equipment, products, processes, and systems of work. All of these have the potential

to cause harm.

The UK Health and Safety Executive states that a risk assessment is "a careful examination

of what, in your work, could cause harm to people, so that you can weigh up whether you

have taken enough precautions or should do more to prevent harm".

There are a number of techniques available when assessing risks, including:

The HSE's 5 Steps to Risk Assessment approach.

Qualitative assessment techniques.

Semi-quantitative assessment techniques.

Quantitative assessment techniques.

We will learn more about these in the following sections.

Before we progress further, it is important to define what is meant by 'hazard' and 'risk'.

A hazard is defined as something with the potential to cause:

Harm, including ill-health and injury.

Damage to property, plant, products or the environment.

Production losses or increased liabilities.

A risk is defined as the likelihood that the harm will occur. It is the chance, high or low, that

a person could be harmed or some infrastructure could be damaged. This is usually

accompanied by an indication of how serious the harm could be.

It is commonly considered that risk is the combination of the likelihood of a hazard causing

harm, and the potential severity of that hazard.














In other words:

Risk = Likelihood x Severity

General Structure of a Risk Assessment.

The risk assessment should be structured and applied so that organisations can:

Identify the hazards created at work and evaluate the risks associated with these

hazards, to determine what measures they should take to protect the health and

safety of their employees and other workers, having due regard to legislative

requirements.

Evaluate the risks in order to make the best informed selection of work equipment,

chemical substances or preparations used, the fitting out of the workplace, and the

organisation of work.

Check whether the measures in place are adequate.

Prioritise action if further measures are found to be necessary as a result of the

assessment.

Demonstrate to themselves, the competent authorities, workers and their

representatives that all factors pertinent to the work have been considered, and that

an informed valid judgment has been made about the risks and the measures

necessary to safeguard health and safety.

Ensure that the preventive measures and the working and production methods,

which are considered to be necessary and implemented following a risk assessment,

provide an improvement in the level of worker protection.

3.2 - The HSE's 5 Steps to Risk Assessment.

The UK's HSE promote a very simple of method called the 5 Steps to Risk Assessment. It is

explained in further depth in their publication INDG163.

The five steps are:

1. Identify the hazards.

2. Decide who might be harmed and how.

3. Evaluate the risks and decide on precautions.

4. Record the findings and implement them.

5. Review the assessment on a regular basis and update if necessary.







http://www.hse.gov.uk/pubns/indg163.pdf











Step 1: Identify the Hazards.

The first step is to identify what might harm people in the workplace. The following

procedure should be followed:

Conduct a tour of the workplace and observe what could reasonably be expected tocause harm.

Consult the workers or their representatives for their views and opinions.

Consult the manufacturers' instructions or data sheets. They will highlight hazards

associated with machinery or substances.

Consult the accident log and ill-health records. These can often indicate less obvious

hazards as well as highlighting trends.

Step 2: Decide Who Might be Harmed and How.

For each hazard, there has to be clear identification of the groups of people who might be

harmed. This will help identify the best way of managing the risk (for example, 'people in

the boiler room' or 'the public'). In each case, identify how they might be harmed i.e. how

exactly will they be exposed to the hazard and what type of injury or ill-health might occur.

For example, workers carrying out maintenance on an electrical panel might suffer an

electric shock if there is a failure to isolate the supply.

Step 3: Evaluate the Risks and Decide on Precautions.Having identified the hazards, the next step is to decide what action to take to reduce the














risks associated with the hazards. In most developed countries the law requires employers

to do everything 'reasonably practicable' to protect people from harm.

When deciding on control measures to minimise the risks to 'as low as is reasonably

practicable' (ALARP), the Hierarchy of Control should be used. We shall look at the meaning

of ALARP later in this Element.

When using the Hierarchy of Control, priority should be given to those control measures at

the top of the following list:

1. Elimination.

2. Substitution.

3. Engineering Controls.

4. Administrative Controls (e.g. safe systems of work, procedures, training and

information etc.).

5. Personal Protective Equipment.

Step 4: Record the Findings and Implement Them.

Implementing the results of the risk assessment is the next step. This requires you to write

down the findings of the risk assessment and share the document with those staff members

involved.

A risk assessment is not expected to eliminate all risks, but it is expected to be 'suitable and

sufficient'. In order for it to meet these criteria, it will need to show that:

A proper check was made.

All of those who might be affected were consulted.

All the significant hazards were addressed.

The recommended risk control measures are suitable and sufficient, and the

remaining risk is low. All the staff or their representatives were involved in the process.

The assessment will be valid for some time.

Actual conditions and events likely to occur have been considered during the

assessment.

If the findings of the risk assessment conclude that there are a number of improvements to

be made, it is appropriate to draw up a prioritised plan of action which clearly identifies

what should be done, by who, and by when. These actions should then be implemented

and management need to check regularly on the progress of the improvements.

Step 5: Review the Risk Assessment and Review if














Necessary.

Few workplaces remain static. Inevitably, new equipment or variations in substances used

and procedures undertaken will introduce new hazards to the workplace. Consequently, it'ssensible to review all control measures on an ongoing basis. They should also be reviewed if

there is an incident which shows that the control measures have not controlled the risk.

Risk Assessments in the Oil and Gas Industry.

This straightforward method should be suitable for most low to medium risk organisations.

But for the oil and gas industry, where there are more complex risks, the techniques used

are likely to require more technical insight and depth. The UK Offshore Installations (Safety

Case) Regulations 2005 (OSCR) requires a demonstration by duty holders that:

All hazards with the potential to cause a major accident have been identified.

All major accident risks have been evaluated.

Measures have been, or will be, taken to control the major accident risks to ensure

compliance with the relevant legal requirements (i.e. a 'compliance demonstration').

The compliance demonstration should be proportionate to the level of risk. Because of the

higher levels of, and more complex, risks in the oil and gas industry, other risk assessment

techniques need to be considered such as:

Types of qualitative risk assessments.

Types of quantitative risk assessments.

Types of semi-quantitative risk assessments.

These techniques are regarded to be more comprehensive and can be used to take in a

wider range of factors, including financial costs, loss of time, loss of business, loss of

reputation etc. In the following pages we will look at these different types of risk

assessment in more detail.

3.3 - Qualitative Risk Assessment.

A qualitative risk assessment is based on the conclusions reached by the assessor using

their expert knowledge and experience to decide:

If current risk control measures are effective and adequate.

Whether those control measures reduce the risk 'as low as is reasonably practicable'.

If more measures need to be implemented.

Since it is based on the risk assessor's knowledge and experience, qualitative risk

assessment is a subjective technique. Qualitative techniques allow the assessor to identify







http://www.hse.gov.uk/pubns/priced/l30.pdf













hazards from specific activities and to develop an understanding of the risks involved and

how serious they may be. This allows them to prioritise the control measures.

Qualitative risk assessment can be used for both low risk and high risk industries. The 5

Steps to Risk Assessment approach is a typical qualitative technique which is appropriate

for most low to medium risk activities. However, there are qualitative methods, such as

HAZOP (which we will study later), that are used frequently in the oil and gas industry.

When applied to the correct level of detail by a team with the required knowledge,

expertise, and experience, qualitative risk assessment techniques can be a powerful risk

management tool.

There are advantages in using the combined skills of a team of assessors. Using a multi-

disciplined team of people with different knowledge and expertise means that a more

complete idea of the risks is obtained. These people may bring additional theoretical

knowledge, or practical experience of how activities and equipment work in reality. This is

much better than relying on the views of a single person.

When a team of assessors is involved, it is better to have them work on the risk assessment

individually at first, and then to bring them together. This will ensure that more dominant

members of the team do not overly influence or subdue the more introverted members of

the team. This would conclude with a debate and comparison of ideas in order to reach a

consensus of opinion and a final decision on which risk control measures should be applied.

When making a qualitative judgement on the severity of a risk, two parameters are taken

into considerations. These are:

The likelihood of an event occurring.

And the consequences or severity if the event does occur.

Severity can be assessed in terms of its effect on:

Harm caused to people. Time lost.

Cost to the organisation.

Cost to quality.

Inconvenience and disruption.

The Benefits and Limitations of Qualitative Techniques.

The benefits of Qualitative Techniques are:

Relatively low cost as the only cost is usually the time of the assessors.














Different methods can be used to assess both low and high risk situations.

Requires minimal training in the risk assessment method compared to quantitative

techniques.

The necessary expertise and knowledge is usually already available in the

organisation.

The limitations of Qualitative Techniques are:

There is a potential for disagreement between the assessors on the level of risk and

what control measures should be put in place. This is because the assessment is

subjective, and people of different experiences can have different opinions.

Cannot quantify the risk precisely. Therefore its findings may be disputed.

The quality of the output of the risk assessment is only as good as the expertise and

knowledge of the assessors.

Examples of Qualitative Risk Assessment Methodologies.

The HSE's 5 Steps to Risk Assessment that we discussed previously is a typical qualitative

process. There is no quantification of the risks, and the outcome is purely down to the

judgement of the assessor. It is a technique that is especially suited to low to medium risk

environments.

However, some qualitative approaches are uniquely placed for the high risk oil and gas

industry. Hazard and Operability Studies (HAZOP) are a qualitative technique used primarily

in high risk process industries. It requires a multi-disciplinary team to use a structured

method to assess the risks from an existing or planned process, and agree control

measures.

Qualitative methods are often used outside of the safety environment, for example to risk

assess commercial opportunities, decisions, and product development. These methods can

include such techniques such as SWOT analysis. However, this is outside of therequirements of the course.

3.4 - Semi-Quantitative Risk Assessments.

This type of risk assessment is actually closer to qualitative i.e. the assessment is still a

subjective one, dependent on the judgment, knowledge and experience of the assessor.

The difference with a true qualitative risk assessment is that the assessors will attempt to

provide a numerical score or value to their assessment of the risk. In practice this means

that a value will be given to the 'likelihood' and 'severity' factors. Some methods will also

include a third factor such as 'number of people exposed' but this is usually not necessary.The individual values of each factor are multiplied together to form a 'risk rating'. Usually














the higher the number, the higher the risk.

This method serves two purposes:

This can be used against a 'risk matrix' to decide whether the risk is acceptable orwhether more needs to be done.

The risk ratings of individual risks can be compared in order to prioritise them.

It is necessary to provide definitions for each numerical value given. For example, if

'likelihood' is scored out of 5, then 1 might be 'extremely unlikely' and 5 might be 'very

likely'. Similarly for 'severity', 1 might mean only a 'first aid injury' and 5 may signify 'death'.

There are no standard definitions. Each organisation will usually develop their own semi-

quantitative method with their own definition and risk matrices. The risk matrix may be assimple as a 3 x 3 system, or as complicated as 10 x 10. See some examples below.

Figure 1. A typical 5 x 5 matrix, colour coded to show what action is required.














Figure 2. A typical 3 x 3 risk matrix.

Figure 3. A slightly more complicated 5 x 5 risk matrix, including consideration of damage to

assets, the environment, and corporate reputation.














Figure 4. A 16 x 13 risk matrix. This one is used to assess the risk of equipment failure.

As we have discussed previously, the use of semi-quantitative risk assessment depends on

the equation:

Risk Rating = Likelihood x Severity

What Action should be Taken for each Risk Level?

Risk matrices are useful to define precisely:

What action is required for each risk level.

At what point an organisation would consider the risk to be sufficiently controlled.

How high the risk needs to be for the organisation to decide to stop the process or

refuse to start the process until the risk is lowered.

A typical 3 by 3 risk matrix would usually say the following:

1. If the risk is 'Low' then the risk is tolerable. No further action is required other than

monitoring of the effectiveness of controls and regular reviews. The goal is to reduce

all risks to this tolerable level.

2. If the risk is 'Medium' then further action should be considered within a specific

timeframe, such as 1 week or 30 days, to bring the risk down to a tolerable level.

3. If the risk is 'High' then the job must stop, or must not start. Immediate controls are














required to bring the risk down to a more acceptable level.

Benefits and Limitations of Semi-Quantitative Risk

Assessment.

The benefits are:

It allows risks to be prioritised and compared against one another.

It provides a clear and consistent definition to the organisation of what risk ratings

are considered acceptable, and which ones need further control measures.

In the event of very high risks with imminent danger, it clearly defines when work

should be stopped (or not started).

It provides a level of consistency to a qualitative system.

The results are easier and quicker to interpret for a busy reader.

The limitations are the same as with qualitative risk assessments:

There is a potential for disagreement between the assessors on the level of risk and

what control measures should be put in place. This is because the assessment is

subjective, and people of different experiences can have different opinions.

Cannot quantify the risk precisely. Therefore its findings may be disputed.

The quality of the output of the risk assessment is only as good as the expertise and

knowledge of the assessors.

3.5 - Quantitative Risk Assessments.

Quantitative Risk Assessment is often called QRA.

It is often said that the level of risk assessment should be proportionate to the risks i.e. the

higher the risk, the more effort should be invested in accurately assessing the risks. In the

oil and gas industry, the hazards associated with complex processes and operations requirea highly sophisticated approach in order to evaluate the risks involved. QRA techniques

provide the means to make a detailed assessment that will be based on quantitative

considerations of event probabilities and consequences. It is a key element tool applied in

safety management and risk control throughout the design, construction, operation and

decommissioning of all industrial activity in order to achieve safe operation and major

hazard control.

These quantitative techniques and tools will seek to:

Identify hazards.

Give a statistical estimate of the severity of the consequences.














Quantify the likelihood of the hazards being realised.

This will result in a reliable numerical estimate of the risks.

Frequently the QRA is combined with a cost-benefit analysis to ensure that the optimumreturn is obtained from investments in risk-reducing measures.

Different Uses of a QRA.

Regulatory compliance where QRA may be required in order to obtain a license to

operate. For example, in the European community, most enforcing authorities

provide strong guidelines on report format and methodologies. For example, in the

UK this is required under the Offshore Installation (Safety Regulations) 2005. Risk prioritisation is used to rank potential hazards or system deficiencies for possible

mitigation.

Corporate policy may require all operations meeting particular criteria to be subject

to QRA. This requirement is most often driven by a need to understand the risks

facing the company and to manage the full set of risks to a tolerable level.

Cost benefit analysis is most commonly used to select risk mitigation measures for

potential implementation. In some cases a QRA may be justified when a

recommendation from a more qualitative study will be expensive to implement and a

more precise level of risk needs to be developed. Identify the potential cost and duration of business interruption.

Information Inputs.

The number of possible inputs into QRA is extremely wide, and what data is required is

dependent on the what kind of process is being risk assessed and the tool used to make the

calculations. QRA is often carried out with the use of sophisticated computer software and

modelling.

Historical failure data is an essential input into most analyses. This might include the failure

rates of equipment and components. For example, it is important to consider the reliability

of a level sensor on an oil tank to prevent overfilling. The data may give an indication as to

how reliable that type of sensor is and the frequency of failure.

The frequencies of failure are calculated by combining accident experience and population

exposure, typically measured in terms of installation-years:

Number of Events Number of Installations x Years of Exposure

One example of a source of historical data which can be used as the basis for quantitative














risk assessments is the Worldwide Offshore Accident Database (WOAD).

Other inputs may include the types of chemicals and hydrocarbons, their respective energy

output in the event of a fire, the heat resistance of materials used, the prevailing wind

conditions etc.

Examples of QRA.

There are numerous tools and techniques and commercial software applications. Common

QRA techniques include:

Fault Tree Analysis.

Event Tree Analysis. Fire and Explosion modelling

Benefits and Limitations of QRA.

The benefits are:

Very objective.

Based on data so reliable and precise.

Theoretical models follow the laws of physics which are constant, therefore themodelling scenarios are considered to be reliable and highly predictable.

The limitations of QRA are:

Tends to be more expensive than simpler qualitative or semi-quantitative methods.

Requires significant expertise and sophisticated software.

Dependent on the availability of the data. If the data is unavailable, then it becomes

more difficult to accurately quantify the risk.

The output is only as good as the data. Limited or inaccurate data will affect theaccuracy of the QRA.

3.6 - How Risk Management Tools are Applied in Process Safety.

When a project is in the design stage, some risks can be 'designed out' i.e. the design is such

that the risk is eliminated. Unfortunately, it is not possible to remove oil and gas from the

oil and gas industry! Therefore some hazards and risks will always remain.

Risk Management through the Lifecycle.

It is important to identify and assess hazards and risks at every stage of the project phases,














from concept, through to the design phase, through to start up, operation, shutdown,

maintenance, and decommissioning. Consideration must also be given to the management

of major incident risks and the mitigation of incidents. Risks must be 'as low as is reasonably

practicable' (ALARP) and we will discuss what this means shortly.

The Steps to Risk Management.

Managing work health and safety risks involves four steps (see figure below):

1. Identifying hazards: finding out what could cause harm

2. Assessing risks (if necessary): understanding the nature of the harm that could be

caused by the hazard, how serious the harm could be and the likelihood of it

happening3. Controlling risks: implementing the most effective control measure that is

reasonably practicable in the circumstances

4. Reviewing control measures: ensuring control measures are working as planned.

Have you noticed that these 4 steps are remarkably similar to the 5 Steps to Risk

Assessment?














Figure 1. The 4 Steps to Risk Management.

Consultation with workers and their health and safety representatives is required at each

step in managing risks to health and safety at the workplace. By drawing on the experience,

knowledge and ideas of workers, organisations are more likely to identify all hazards and

choose effective control measures.

Workers should be encouraged to report any hazards and health and safety problemsimmediately so that risks can be managed before an incident occurs.

If there is a health and safety committee for the workplace, it should also be engaged in

managing health and safety risks at the workplace.

In the following sections we will review a number of risk assessment tools that are

commonly used within the oil and gas industry.

Hazard Identification Studies (HAZID).

Hazard and Operability Studies (HAZOP). Failure Modes and Effective Criticality Analysis or Failure Modes and Effects Analysis














(FMECA and FMEA respectively).

3.7 - Hazard Identification Studies (HAZID).

HAZID, as its name suggests, is a tool for identifying hazards. It is normally a qualitative risk

assessment and is judgement based. It is usually undertaken by a team of people who will

be selected because of their particular knowledge, experience, or expertise.

The reasons for identifying hazards are twofold:

1. The compile a list of hazards which can then be evaluated using further risk

assessment techniques.

2. To conduct a qualitative evaluation of how significant the hazards are and how to

reduce the risks associated with them.

The following features are essential elements of a hazard identification study:

A wide scope of hazards should be considered.

The study should follow a structured approach so as to be comprehensive in its

coverage of relevant hazards.

The study should embrace historical data and previous experiences so that lessons

learnt can be acted upon.

The scope of the study should be clearly defined. This is to ensure that those whoread the study fully understand what parts of the process and what hazards have

been included, and which have been excluded.

Hazard Checklists.

Checklists are an effective means of producing a comprehensive list of standard hazards

which can be used for HAZID studies at the concept and design stages of a project to

consider a wide range of issues related to safety. It is also used to confirm that goodpractice has been built into a project at the design stage.

The hazards considered may include:

Substance specific, such as:

o Hydrocarbons.

o Toxic materials.

o Liquids and gases under pressure.

o

Hot or cryogenic fluids.o Explosive substances and gases.

Equipment specific, such as:













3.7 - Hazard Identification Studies (HAZID).

o Dangerous equipment.

o Ignition sources.

o Lifting equipment.

o Ionising radiation.

o Non-ionising radiation.

o Failure of equipment such as utilities, safety systems, instrumentation, and

control systems.

General hazards, such as:

o Transportation and traffic.

o Weather.

o Slips and tips.

o Working at Height.

o Diving operations.o Manual handling.

Benefits and Limitations of a Hazard Checklist.

The benefits are:

Relatively cheap to produce and can be created by a single person.

It can be used to help prevent the recurrence of previous incidents.

It can be used for concept designs with a minimum of installation information. It can use the experience gained from previous risk assessments.

The limitations are:

It may not be able to anticipate accidents which may occur in new designs.

Using a generic checklist does not encourage new thinking about possible hazards,

which can limit the understanding of the types of hazard specific to the installation.

In conclusion, a generic checklist is a useful tool for most risk assessments, although it isadvisable to use it alongside other hazard identification study methods.

3.8 - Hazard Operability Studies (HAZOP).

What is a HAZOP?

A hazard and operability (HAZOP) study is method that is used often in the petrochemical

industries. It is a structured and systematic examination of a planned or existing process or

operation in order to identify and evaluate problems that may represent risks to personnel

or equipment, or prevent efficient operation. It will identify deviations from design intent,

determine the causes, and recommend solutions. It is a Qualitative process.














When is a HAZOP performed?

The HAZOP study should preferably be carried out as early in the design phase as possible.

This is so it has an influence on the design. On the other hand, to carry out a HAZOP acomplete design is required. As a compromise, the HAZOP is often carried out as a final

check when the detailed design has been completed. A HAZOP study may also be

conducted on an existing facility after a major modification, following a major accident, and

periodically as a review.

The HAZOP Team.

The team will be led by a Team Leader or Chair who will be someone experienced in the

HAZOP process. They will initially agree the scope of the analysis, and be involved in the

selection of team members. They will direct the team members in gathering of process

safety information prior to the start of the study, and lead the team in the analysis of the

selected process or part of the process.

At the end of the exercise the Team Leader will write a report detailing the study findings

and recommendations, and report the findings and recommendations to management.

Other team members may include:

Secretary or scribe.

Design engineer.

Mechanical engineer.

Electrical or Instrument engineer.

Operations representative.

Process Engineer.

Safety specialist.

The HAZOP Procedure.

HAZOP is applied to processes (existing or planned) for which design information is

available. This commonly includes a process flow diagram, which is examined in small

sections, such as individual items of equipment or pipes between them. For each of these a

design 'Intention' is specified. For example, in a chemical plant, a pipe may have the

intention to transport 2.3 kg/s of 96% sulphuric acid at 20°C and a pressure of 2 bars from a

pump to a heat exchanger. The intention of the heat exchanger may be to heat 2.3 kg/s of

96% sulphuric acid from 20°C to 80 °C.

The HAZOP team then determines what are the possible significant deviations from each














intention, the possible causes, and likely consequences. It can then be decided whether

existing, designed safeguards are sufficient, or whether additional actions are necessary to

reduce risk to an acceptable level.

The key feature is to select appropriate Process Parameters which apply to the design

intention. These are general words such as Flow, Temperature, Pressure, and Composition.

In the above example, it can be seen that variations in these parameters could constitute

deviations from the design Intention.

In order to identify Deviations, the Study Leader applies (systematically, in order) a set of

Guide Words to each parameter for each section of the process.

Guidewords include: No, More, Less, As Well As, Part Of, Reverse, Other than.

Process Parameters include: Flow, Pressure, Temperature, Level, Viscosity, Composition,

pH.

Let us present a simplified example:

1. We begin with a deviation. In the example above we choose 'TEMPERATURE of

sulphuric acid in pipe is MORE than 20°C'. We ask the question 'Is this possible?'

2. If it is not possible we move on to the next deviation. If it is possible we ask whether

it is hazardous or affects efficiency.3. Since this deviation is possible, we ask whether the operator will know the

temperature is more than 20°C. If not, then the HAZOP team must consider what

mechanism or process needs to be established so that the operator is aware of this

deviation.

4. We would then establish what changes to the plant, machinery, or operating

procedures are necessary in order to prevent the deviation, make it less likely, or

protect against the consequences.

5. We must consider whether the change is cost effective. If not then other changes

must be considered, otherwise the team must agree to accept the hazard.

6. The changes are agreed and someone is made responsible for implementing them.

7. A follow up process is needed to ensure the agreed changes are implemented.

On completion of a HAZOP study the possible outcomes include:

No actions required.

Improvements in operating or maintenance procedures.

Hardware or design changes.

A more detailed quantitative risk assessment required.














Figure 1. HAZOP process flowchart.

The Benefits and Limitations of HAZOP.

Its benefits are:

HAZOP studies are well known and widely used in the oil and gas industry.

They use the knowledge and experience of operators.

They systematically examine every part of the design, identifying every possible

deviation.

They can identify technical faults and human errors. They can evaluate existing controls, and propose further controls.

The use of HAZOP offshore is useful in that it brings together different professional

disciplines from different organisations.

Its limitations are:

Its success depends on the effectiveness of the team leader, and the knowledge and

experience of the team.

It is best suited for process hazards. It cannot identify general safety hazards withoutsubstantial changes to how it works.

Procedural descriptions are needed, and these may not be available in sufficient














detail to identify all conceivable scenarios.

The documentation required to record the findings fully can be extensive and

overwhelming.

3.9 - HAZOP Process Illustrated.

Figure 2. The HAZOP process illustrated.

3.10 - Failure Mode and Effects Analysis (FMEA).

What is an FMEA?FMEAs evaluate the ways equipment, components, and physical systems can fail and the














effects these failures can have. In an FMEA, each individual failure is considered as an

independent occurrence with no relation to other failures in the system, except for the

subsequent effects the original failure may produce. Basically, FMEAs identify single failure

modes that either directly result in or contribute significantly to an accident.

FMEAs are conducted to improve the safety of equipment by:

Identifying single component, equipment and system failure modes.

Determining the potential effects on the equipment, system, or plant associated with

each individual failure mode.

Generating recommendations for increasing reliability of the component, equipment

and/or system.

What is the FMEA process?

There are basically 5 steps involved in the FMEA process:

Break the system into component parts.

Determine how each component may fail.

Determine the possible effects of these modes of failure.

Consider how each failure mode can be detected.

Assess the consequences of the failure on the system or other components.

An example FMEA, concerning an automated cash machine (also known as an ATM), is

given in the figure below.

Under the potential failure modes, there are three identified possible failure mode in

dispensing cash, and their respective effects and potential causes. Severity is ranked for the

respective failure mode from a low severity of 1 to a high 10. Occurrence is scored in the

same manner while detection is scored in reverse. If a failure is highly detectable, the score

is low. Hard to detect failures should be scored high in detection.

It is worth noting that the below example is a simplified version. A full FMEA on a system

would be much more detailed.














Figure 1. Example FMEA for an automated cash machine.

The Risk Priority Number (RPN) is the product of Severity, Occurrence and Detection (RPN =

S x O x D). The higher the RPN, the higher the risk.

Based on the above table, priority should be given to internal jamming because it has the

highest RPN. Also running out of cash is a priority because of its 'critical characteristic'.

Resources should therefore be aimed towards preventing and controlling these two

failures.

Since it uses scores it is a semi-quantitative technique.

In summary, FMEA failures are prioritised according to how serious their consequences are,how frequently they occur and how easily they can be detected. FMEA is used during the

design stage with an aim to avoid future failures. Later it is used for process control, before

and during ongoing operation of the process. Ideally, FMEA begins during the earliest

conceptual stages of design and continues throughout the life of the product or service.

The Benefits and Limitations of FMEA.

The benefits are:

It is a well used and understood hazard analysis tool.














It may only be used by one person to perform the analysis.

It should identify all conceivable electrical and/or mechanical hazards.

It identifies safety critical equipment and components where a failure would be

critical to the system.

The limitations are:

It's dependent on the experience and knowledge of the analyst.

The analyst needs to develop a hierarchical system drawing before they can perform

the analysis.

It is limited to mechanical and electrical equipment and is not applicable to

procedures or process equipment.

Human errors and multiple failures are difficult aspects for it to cover.

It is likely to produce a large and complex list of failures.

FMEAs should not be used by themselves because human error is a contributing factor in

many accidents and it is difficult for FMEA to identify this.

3.11 - The Concept of 'As Low as Reasonably Practicable' (ALARP).

We have mentioned a number of times the phrase 'as low as is reasonably practicable'. But

what does this mean?

There are risks in every aspect of our lives, both in our personal lives (such as crossing the

road) and in our work activities. What we must do is reduce those risks to an acceptable

level, without taking excessive or disproportionate action.

What this means is that organisations must introduce appropriate control measures unless

the cost is 'grossly disproportionate' to the risk reduction. Once all such measures have

been introduced, the risks are said to be 'as low as is reasonably practicable'. The ALARP

principle arises from the fact that infinite time, effort and money could be spent on the

attempt of reducing a risk to zero, and there is a point at which it becomes unreasonable to

spend anymore time, effort, and money on trying to reduce that risk. That point is called 'As

low as is reasonably practicable'.

It should not be understood as simply a quantitative measure of benefit against detriment.

It is more a best common practice of judgement of the balance of risk and societal benefit.

For example, to spend £100,000 replacing the six chairs in the control room with ones with

better back support would be regarded as grossly disproportionate.

However, to spend £1,000,000 on installing a fully protected escape route from thetemporary refuge facility to the lifeboats and helideck could be regarded as far more













3.11 - The Concept of 'As Low as Reasonably Practicable' (ALARP).

proportionate.

In the oil and gas industry the risk of fire and explosion and their consequences rank highly,

not only in financial terms, but also to human life and the environment. Therefore control

measures that are considered disproportionate in a lower risk environment are considered

reasonable and proportionate in the oil and gas industry. The risk is so high that much more

stringent control measures will be needed to reduce the risk to a level that can be regarded

as 'ALARP'.

In most situations, deciding whether the risks are ALARP involves a comparison between

the control measures the organisation has in place and the measures we would normally

expect to see in such circumstances. The question to be asked is 'is it good practice?' Good

practice is defined by the UK HSE as those standards for controlling risk that the HSE has

judged and recognised as 'satisfying the law, when applied to a particular relevant case, in

an appropriate manner' . Examples of good practice may include HSE Approved Codes of

Practice and Guidance Notes, Industry Standards, and standards produced by organisations

such as ISO (International Organisation for Standardisation).

Figure 1. Chart outlining the concept of ALARP. 3.12 - Management of Major Incident Risks.













3.12 - Management of Major Incident Risks.

When it comes to managing the risks of a major incident, this should take hierarchical

approach. The recommended hierarchy is:

1. Elimination and minimisation of hazards (designing safety into process and systems).

2. Prevention (the reduction of the likelihood of a major incident).

3. Detection (the warning and alarm systems transmitted to the control area).

4. Control (the limitation of the scale, the intensity and/or the duration of an incident).

5. Mitigation of consequences (the protection from effects of an incident).

Figure 1. Hierarchy of controls for major incident risks.

Inherently safer design and measures to prevent and control major accident hazards are

the highest priority. This is because they have the greatest effect and are more effective at

reducing the risk. The best time to identify and eliminate the risk of major hazards on a new

installation is at the design stage. This is the stage at which all elements of the process and

plant are examined, tested, and where the risks are prioritised in order of significance.

It is always best to prevent or eliminate risks by engineering design which will make the













3.12 - Management of Major Incident Risks.

installation inherently safe. Then any residual risks can be controlled by the implementation

of other controls such as management systems.

It is more difficult to eliminate or prevent risks on existing installations, although they

should be reduced to ALARP regardless of the difficulties.

3.13 - Industry-Related Process Standards, Engineering Codes, and Good Practice.

What are 'Standards'?

In essence, a standard is an agreed way of doing something. It could be about making a

product, managing a process, delivering a service or supplying materials. Standards can

cover a huge range of activities undertaken by organisations and used by their customers.

The standard is documented and the organisation will attempt to replicate this way ofworking.

Standards are the distilled wisdom of people with expertise in their subject matter and who

know the needs of the organisations they represent, people such as manufacturers, sellers,

buyers, customers, trade associations, users or regulators. Standards are useful tools to

ensure consistency, reliability, efficiency, and safety. Standards are particularly important

for the oil and gas industry as they simplify global procurement and assuring quality. These

standards ensure the quality of most of the equipment used in the industry, such as fittings,

flanges, and valves, as well as management systems and procedures.

Who Creates Standards?

The oil and gas industry is a multinational operation and is governed by both national and

international health and safety regulations and codes of practice which are developed and

enforced by governmental departments and other authorities throughout the world (such

as OSHA in the USA, and the HSE in the UK).

In addition to these governmental authorities there are a number of industry bodies which

produce guidance and international standards which oil and gas organisations can use to

ensure they are following good practice. Governments and enforcing authorities tend to

work with these industry bodies to develop these international standards and codes of

practice which are born out of specialised knowledge and experience.

Models of risk management which have developed over time are shared globally

throughout the industry, and minimum standards of health and safety become commonly

accepted and adopted by multinational companies. The industry bodies also serve as a

forum for the exchange of ideas as wells as a communication method to notify others of

hazards or improved working practices.







https://www.osha.gov/index.html



http://www.hse.gov.uk/











3.13 - Industry-Related Process Standards, Engineering Codes, and Good Practice.

Notable nongovernmental industry bodies which produce guidance and standards include:

International Association of Oil and Gas Producers (IOGP).

Oil and Gas UK.

OPITO. (Offshore Petroleum Industry Training Organisation)

International Organisation for Standardisation (ISO).

A useful document which show the large number of relevant ISO standards is available on

the IOGP website here: http://www.iogp.org/Portals/0/Standards/standardsposter.pdf

Examples of relevant ISO standards include:

ISO 19900 General Requirements for Offshore Structures.

ISO 14001 series Environmental Management Systems.

3.14 - Inherent Safe and Risk Based Design Concepts.

One of the main elements of developing inherently safe processes is to recognise that, by

reducing the complexity of the plant at the design stage, and simplifying the operation

process, a significant reduction in the likelihood of accidents can be achieved. This is

because there is less equipment to malfunction and fewer opportunities for human error.

The design of a process which is as inherently safe as possible is the main goal of processdesigners. It is impossible to design out all risks, but process designers can use a

hierarchical approach, with hazard avoidance being the priority, followed by the control of

any risks remaining.

Control features, such as designing a system which can withstand the maximum likely

pressure possible, are desirable elements where hazards cannot be designed out

completely. However, where control is not possible, then mitigation by designing in means

of reducing the magnitude of a hazard if it is realised is acceptable.

The basic principles of inherently safe design are as follows:

Minimisation. 'What you don't have, can't leak.' Smaller inventories of hazardous

materials reduce the consequences of leaks. Inventories can often be reduced in

almost all unit operations as well as storage. This also brings reductions in cost, while

less material needs smaller vessels, structures and foundations.

Substitution. If minimisation is not possible, an alternative is substitution. It may be

possible to replace flammable refrigerants and heat transfer with non-flammable

ones, hazardous products with safer ones, and processes that use hazardous rawmaterials or intermediates with processes that do not. Using a safer material in place

of a hazardous one decreases the need for added-on protective equipment and thus







http://www.iogp.org/IOGP


http://www.oilandgasuk.co.uk/


http://www.opito.com/


http://www.iso.org/iso/home.htm


http://www.iogp.org/Portals/0/Standards/standardsposter.pdf














3.14 - Inherent Safe and Risk Based Design Concepts.

decreases plant cost and complexity.

Moderation. If minimisation and substitution are not possible or practicable, an

alternative is moderation. This means carrying out a hazardous reaction under less

hazardous conditions, or storing or transporting a hazardous material in a less

hazardous form. For example you could reduce the temperature or pressure of a

process, even though this might take longer.

Simplification. Simpler plants are inherently safer than complex plants, because they

provide fewer opportunities for error and contain less equipment that can go wrong.

Simpler plants are usually also cheaper and more user friendly. Problems should be

designed out, rather than adding equipment to deal with those problems.

Error Tolerance. Equipment should be able to tolerate deviations, poor installation,

or maintenance without failure. For example, expansion loops in pipework are more

tolerant to poor installation than bellows. Piping and joints can be made capable ofwithstanding the maximum possible pressure if outlets are closed.

Limitation of Effects. If the above cannot prevent an incident, the effects of the

failure should be limited. For example, the overpressure from explosions can be

directed away from populated parts of the installation, or bunds can be installed

around storage tanks.

Preventing Human Error. Failsafe features should be designed in, such as valves

which fail to a SHUT position. Equipment should be chosen so that it can be easily

seen whether it has been installed correctly or whether it is in the open or shut

position. Safe plants are designed so that incorrect assembly is difficult or impossible. Avoiding Knock-On Effects. Safer plants are designed so that those incidents, which

do occur, do not produce knock-on or domino effects. For example safer plants are

provided with fire breaks between sections to restrict the spread of fire, or if

flammable materials are handled, the plant is outside so that leaks can be dispersed

by natural ventilation.

The possibility for affecting the inherent safety of a process decreases as the design

proceeds and more and more engineering and financial decisions have been made. It is

much easier to change the process configuration and inherent safety in the conceptual

design phase than in the later phases of process design. For instance the process route

selection is made in the conceptual design and it is many times more difficult and expensive

to change the route later. Time and money is also saved when fewer expensive safety

modifications are needed and fewer added-on safety equipment are included to the final

process solution.













3.15 - The Concept of Hazard Realisation.

When a hazard leads to injury or damage we say that the 'hazard has been realised'. It is

where a hazard control system has failed which, in turn, causes a hazardous event to occur.

The realisation of a hazard can be catastrophic in the oil and gas industry. Here is an

example based on the Buncefield disaster:

1. During tank filling the overfill sensors fail, and the tank filled until it spills over the top

of the tank.

2. The spillage of highly flammable liquid creates a large vapour cloud which travels

until it finds an ignition source. It ignites.

3. The ignition causes a large explosion.

4. The explosion leads to damage, injuries and fatalities.

5. Other tanks are damaged, leading to further loss of containment and more fire.

Luckily the Buncefield disaster did not result in any fatalities.

Let us look at another example now, the Feyzin disaster in France in 1966.

Feyzin Disaster, 1966.

Three operators were draining water from a sphere containing LPG. This was a routine

procedure, but none of the operators carrying out the task on this occasion had any

experience in performing the task. There was a written procedure which showed how toopen the valves in a specific sequence, but this was not referred to by the operators.

Consequently the valves were not opened in the correct order. and the closest one to the

sphere was opened first. A plug of ice formed around the internal mechanism of the valve,

making it inoperable so the operators were unable to close it.

LPG then began to flow from the drain valve, expanding and causing a huge vapour cloud.

Being unable to close the valves (due to the ice plug), the operators ran away. The vapour

cloud drifted over a nearby road and ignited (probably due to a vehicle exhaust). The flames

then travelled back to the leaking sphere and resulted in a jet fire which then spread toanother LPG sphere. This caused a Boiling Liquid Expanding Vapour Explosion (BLEVE, which

we will study in Element 4) and the sphere exploded. Other spheres collapsed as their

support legs buckled because of the heat, and in turn they also exploded.

In total five spheres were destroyed even though the emergency services were at the

scene. This was because they failed to cool the nearby tanks and the surrounding areas, and

a domino chain of explosions was allowed to occur.

18 people were killed, including 11 firefighters and the driver of the vehicle whose exhaustignited the vapour cloud. Over 100 people were injured.













3.15 - The Concept of Hazard Realisation.

Figure 1. An aerial image after the Feyzin disaster.

Lessons Learnt from Feyzin.

The Feyzin disaster raised a number of issues, including:

The design of spheres, the safe distance between them, and the fire protection and

insulation requirements of pipework, valves, and tank supports.

Procedures for draining water from spheres. The need for fully trained and competent personnel.

The need for emergency planning and procedures, so that emergency services know

how to manage similar incidents.

The Feyzin disaster shows how poor design, the lack of effective training, and human error

can come together to 'realise a hazard' and turn it into a large catastrophic event.

3.16 - Risk Control Using Barrier Modelling.

A barrier can be described as something which prevents or minimises harm.

Something which is placed between a person and a hazard to prevent them from

being harmed.

Something which mitigates the effects of an incident and minimises the harm caused.

Barriers to Prevent Harm to People.

Barriers to prevent harm to people are easily recognisable in our everyday lives. They can

be the physical barrier which prevents us from falling off of a balcony, or suncream which isa physical barrier between the skin and the harmful rays of the sun.














Barriers can also be intangible things such as procedures, knowledge, and training. A permit

to work system is a barrier. But how effective that barrier is depends very much on how

well the system is designed and how well people use it.

Some barriers are more reliable than others. The most reliable barriers are those which are

based on good design and engineering, and therefore do not rely on human intervention.

An example may be an automatic gas detection system which is connected to an

emergency shutdown system. However, even these barriers can fail, perhaps due to

unforeseen conditions or technical faults.

Barriers that are less reliable are those which are reliant on people to operate. Since people

are susceptible to making mistakes, or breaking rules, barriers which rely on people have

limited effectiveness and should not be relied on to protect from major risks. For example,

a common barrier in use is Personal Protective Equipment (PPE). But PPE is sometimes not

worn, not available, not suitable, and can be breached in a variety of ways. It also only

protects the person wearing it.

Preference should therefore be given to barriers which do not rely on people, and which

are 'collective' in nature i.e. they should protect everyone in the area and not just a

selection of people.

Use of Multiple Barriers.Since no barrier is 100% effective, it makes sense to use a combination of different barriers

to attempt to control the risk. If one barrier fails, there is then a good chance that an

incident may be prevented by the other barriers in place. This is often referred to as the

Swiss Cheese Model. Every barrier has a 'hole', and the logic is to provide enough barriers

to reduce the likelihood of the holes lining up and allowing a risk through.














Figure 1. The Swiss Cheese Model, illustrating how multiple barriers are needed to fully

control certain risks.

Mitigation (or Recovery) Barriers.In addition to preventing incidents, barriers can also be introduced to minimise the effects

of an incident if it does occur. These are barriers that are initiated after the event, and the

purpose is to reduce the severity of the incident, including the numbers of people who are

affected. For example, in the event of a fire there will be measures to protect people from

the fire including fire resistant evacuation routes, safe refuges, clean air being pumped into

accommodation blocks, and emergency lighting.

Use of Bow Tie Models.

The Bow Tie method is a risk evaluation method that provides a visual representation of the

preventative and reactive barriers. The method takes its name from the shape of the

diagram that you create, which looks like a man's bow tie. A Bow Tie diagram does two

things. First of all, a Bow Tie gives a visual summary of all plausible accident scenarios that

could exist around a certain Hazard. Second, by identifying control measures the Bow Tie

displays what a company does to control those scenarios.

The Bow Tie model was developed by Shell to meet the requirements for risk assessment,

whilst integrating the understanding of how accidents happen, derived from the Swiss

Cheese Model.

The left hand side of the bow tie describes how events and circumstances can release a

hazard which, dependent upon the effectiveness of the systems and activities in place

(active controls and barriers), can lead to an undesired event (the 'Top Event'), with the

potential for harm to people, assets or the environment.

The right hand side represents the scenarios that may develop from the undesired Top

Event (the Consequences), dependent upon the effectiveness of the systems and activities

(reactive controls and barriers).

Active barriers are put in place to prevent the hazards from causing the Top Event, and

Reactive barriers put in place to reduce the Consequences. Each barrier relies on one or

more activities being carried out by an Organisation, such as design, engineering, or

operations, to ensure its presence and effectiveness. Barriers can be 'Hard' (such as fire

explosion wall design) or 'Soft', such as procedures and individual competence.

Bow Ties have the advantages of being a clear graphical representation of what can

sometimes be complex safety systems. In addition, they show clear links safety and














management systems.

Figure 2. Example of a Bow Tie diagram.

Involvement of Workers.

Employees should be consulted and involved in the production of barrier models. They are

the people who are usually most familiar with the hazards and risks they face on a daily

basis. They have a lot of familiarity with the various control measures and can informmanagement on how effective these controls are in practice and what other controls may

be required. They are also the people who are most likely to suffer the consequences of an

incident, and therefore it is morally right to make sure they are satisfied that sufficient

controls are in place to protect them.

3.17 - Use of Modelling such as Thermal Radiation Output.

Consequence modelling refers to the calculation or estimation of numerical values (or

graphical representations of these) that describe the credible physical outcomes of loss of

containment scenarios involving flammable, explosive and toxic materials with respect totheir potential impact on people, assets, or safety functions.

There are a number of modelling techniques and tools available to help in identifying risks

of fire and explosion. These are usually based on mathematical calculations, formulae, and

computer software capable of 'modelling' scenarios and predicting consequences.

Computational Fluid Dynamics.

Computational Fluid Dynamics (CFD) can be used to obtain numerical solutions for

ventilation, dispersion and explosion problems for both offshore platforms and onshore














plants. CFD simulations are becoming increasingly common as the computing power of

standard desktop computers grows. The purpose of the assessment is to generate realistic

air overpressure data for an area based on probabilistic arguments. Ventilation, gas leaks,

dispersion as well as gas explosions are considered by establishing probable explosion

scenarios and performing computer based explosion simulations.

Fire and Thermal Radiation Modelling.

Fire modelling is typically used to calculate the flame dimensions for 2 purposes:

As input to a thermal radiation model.

To determine whether a flame can reach a vulnerable (e.g. other equipment or

accommodation).

The types of fires that modelling can be applied to are varied, and can include jet fires, pool

fires, flash fires and Boiling Liquid Expanding Vapour Explosions. We will study these types

of fire in Element 4. CFD models can be used to determine the fire loading on critical areas

on both offshore structures and onshore plant.

Explosion and Blast Modelling.

For Quantitative Risk Assessment and associated studies, explosions are usually taken tomean vapour cloud explosions (VCEs). However, other types of explosion are possible to

model such as dust explosions and runaway reactions.

In addition, BLEVEs and vessel bursts generate overpressures that may be significant.

The use of modelling allows the calculation of the size of blast zones, with the level of

damage to be expected at various distances, the level of overpressure, the direction of the

overpressure (taking into account the presence of obstacles and the local topography) and

the effect on people and structures.

What Modelling is Used for.

An understanding of the behaviour of heat (and smoke) output from fires can help to

determine the control measures required to protect plant and personnel. For example:

How much separation distance is required between high hazard process areas and

accommodation areas?

What is the best location of accommodation buildings and control rooms and what

fire protection do they require.














Modelling computer software can also be used to calculate:

Dispersion rates of flammable and toxic gases, including concentrations at any given

distance from the release (on and off site).

Evaporation rates of flammable liquids (for example: an LNG spill).

The types and magnitude of any fires, including intensity of the thermal radiation and

maximum pressure generated by an explosion.

Modelling is a valuable tool to assist in examining possible major hazard scenarios, and is

useful in safety case development and justification. Modelling software exists for

substances which include LNG, LPG, Chlorine and Ammonia.

Modelling and computer "generated predictability" can be used for:

Identifying the size and shape of blast zones, with levels of predicted damage.

Choosing the most appropriate fire fighting equipment or protection.

Calculating the specifications of safe havens and refuges.

Selecting the best location and protection of safety critical controls.

Avoiding conflict of activities (storage, flaring, draining etc.).

Figure 1. 3D model of smoke spread on a platform.














Figure 2. Gas plume modelling.














Figure 3. Model of blast zone.

Figure 4. An illustration of different levels of damage resulting from a hypothetical blast.













Question 7.

What is the definition of a 'hazard'?

Question 8.

Put the 5 Steps to Risk Assessment into the correct order.

Question 9.

Match the action to be taken according to the risk level on a risk matrix.

Question 10.

Put these ways of managing risk into the hierarchical order of priority, from most effective

to least effective.

Question 11.

Which risk management tool uses the concept of prevention and mitigation barriers to

prevent and mitigate the risks from 'top events'.

3.18 - Example Exam Questions on Risk Management Techniques Used in the Oil and Gas

Industries.

Here is a selection of past exam questions on risk management techniques. As we have said

previously, there is no guarantee that these questions will ever be asked again, but these

will give you a good idea of the types of questions you could be asked.

1. (a) Identify the key stages of a workplace risk assessment. (5)

(b) Outline the meaning of 'as low as reasonably practicable' (ALARP). (3)

2. A hydrocarbon gas plant and nearby plant suffered catastrophic damage when a gas

cloud exploded after coming into contact with an ignition source. The damage may have

been minimised if an associated deluge system had activated and an emergency shutdown

of the plant had been performed.

The disaster occurred when a pressure safety valve was removed for maintenance and a

blank was attached to the open pipework within a permit-to-work system. The blank was

not tightened sufficiently and when the pipework was re-commissioned a flammable gas

cloud leaked from the loose blank.

Similar disasters may be prevented within the oil and gas industry through risk control in the

orm of barrier models.













3.18 - Example Exam Questions on Risk Management Techniques Used in the Oil and Gas

Industries.

(a) Using the description and the diagram above (the top event being the gas explosion),

identify :

(i) ONE hazard; (1)

(ii) TWO hazard control barriers; (2)

(iii) TWO recovery measures; (2)

(iv) ONE consequence. (1)

(b) Outline reasons for involving all workers in the development of barrier models. (2)

3. Within onshore and offshore installations thermal radiation output modelling is a form of

consequence modelling that helps with risk identification.

a) Give the meaning of consequence modelling. (3)

4. Risk management tools and techniques are used to minimise hazardous events associated

with oil and gas exploration and production activities.

(a) Identify risk management tools and techniques. (6)

(b) Identify the steps of risk management AND outline EACH of the steps identified. (8)

(c) Identify project phases where risk management applies. (6)

5. A quantitative risk assessment is to be used instead of a qualitative risk assessment on a

project to expand an existing oil and gas installation.

a) Outline the meaning of a qualitative risk assessment. (4)

b) Outline how a quantitative risk assessment differs from a qualitative risk assessment. (2)

c) Outline the concept of as low as reasonably practicable (ALARP). (2)













3.19 - Summary.




The purposes and uses of risk assessment.

The definitions of hazard and risk.

The principles of the 5 Steps to Risk Assessment.

The differences between Qualitative, Semi-Quantitative, and Quantitative Risk

Assessment.

About the use of Risk Matrices.

About various risk management and assessment tools such as HAZID, HAZOP and

FMEA.

What ALARP means.

The principles of the hierarchy of controls for major incident risks.

What Standard and Codes are, and who produces them for the offshore industry.

The principles of Inherently Safe Design.

How barrier models can assist in risk control.

How consequence modelling can assist with thermal radiation output and blast zone

identification.

4.0 - Documented Evidence (Safety Cases and Safety Reports).




In this section we will discuss the documented evidence i.e. safety cases and safety reports.

In particular we will explain:

What is meant by safety case and safety report.

The different reasons these are required.

The purposes of this documentation.

The typical contents of both.

4.1 - What are Safety Cases and Safety Reports?

In Europe and Australia, over recent years, there has been a marked shift in the regulatory

approach to ensuring system safety. Up until the 1980s and 1990s organisations had tocomply with prescriptive safety codes and standards. Their compliance was then checked

and enforced by the enforcing authority. Now, the responsibility has shifted back onto the













4.1 - What are Safety Cases and Safety Reports?

developers and operators to demonstrate that their systems achieve acceptable levels of

safety.

To demonstrate that their operation is safe they are required to produce a 'safety case' or a

'safety report' for the enforcing authority. This contains all of the documented evidence to

persuade the authority that the operation is safe and should be allowed to proceed.

Safety cases are the documented evidence for offshore installations, such as oil and gas

platforms.

Safety reports are the documented evidence for onshore installations, such as refineries.

4.2 - The Requirements for Documented Evidence.

Legal Compliance.

In some countries the production of this documented evidence is a legal requirement

before an installation is permitted to be built or operate.

For offshore installations, there are regulations in the UK which are specific to the offshore

oil and gas industry. These are the Offshore Installations (Safety Case) Regulations 2005

(also known as OSCR). These regulations set out specific requirements to provide evidence

and information that present a clear, comprehensive, and defensible argument that asystem is adequately safe to operate. The document produced to provide this evidence is

called a 'safety case'.

For onshore installations, these are regulations in the UK which are specific to the onshore

oil and gas industry. These are the Control of Major Accident Hazards Regulations 1999

(also known as COMAH) and their amendments made in 2005. Again the regulations set out

specific requirements to provide evidence and information that present a clear,

comprehensive, and defensible argument that a system is adequately safe to operate. The

document produced to provide this evidence is called a 'safety report'.

Other Reasons.

Similar legislation exists in some other countries around the world, such as Australia.

However, for those countries that don't have specific legislation organisation may still need

to produce a safety case because of the globalised nature of the oil and gas industry.

Other parties may also request access to an organisation's documented evidence. For

example it may be required during an application for insurance to demonstrate that the riskis as low as possible.













4.2 - The Requirements for Documented Evidence.

Interested parties may include:

Loss adjusters and insurance companies for insurance applications and claims

purposes.

Clients who may be checking that your organisation has an effective safety

management system.

It may be used by the enforcing authority and any external accident investigation

teams in the event of a major incident.

The employees and their safety representatives who may need access to the

evidence for training, communication, and consultation purposes.

The local community and residents, particularly where they may be affected by a

major incident.

4.3 - The Purpose of Documented Evidence.

As we discussed in the last page, the main purpose is to demonstrate the safety of an

installation or facility. If there are legal requirements for this evidence then another

purpose is to also comply with the local legislation.

The safety case or safety report covers all aspects of health and safety on an installation or

facility. It is submitted at the planning stage and remains in place throughout the lifespan of

the facility until it is decommissioned. It is reviewed at five yearly intervals by the enforcing

authority or Regulator, or sooner if requested. It should also be reviewed if there are

significant modifications to the operation of the facility. This regular process of reviewing

and updating ensures the continued safety of the facility throughout its lifespan.

4.4 - Typical Content of a Safety Case.

In the UK The Offshore Installations (Safety Case) Regulations 2005 (OSCR) came into force

on April 6th 2006. As mentioned, there are significant changes to the regulatory

requirements as a result of the introduction of OSCR, including a duty on the installation

operator or owner to consult safety representatives on the preparation, review or revisionof safety cases. The safety case should show how this was done.

You can access the HSE's guidance document on OSCR here:

A Guide to the Offshore Installations (Safety Case) Regulations 2005 (L30).

















Figure 1. Frontpage of the L30 document.

An operator or owner is required by OSCR to submit a safety case to HSE for each

installation. This is a written demonstration of safety that has to be updated whenever

necessary, to reflect changing knowledge and operational conditions. HSE must accept the

safety case before an installation can operate. In reaching a decision about acceptability,

HSE assesses the content of the safety case. The Assessment Principles for Offshore Safety

Cases (APOSC) guide that assessment.

APOSC is for use by HSE assessors and industry safety practitioners. In publishing this

document, the HSE aims to provide an understanding of how the HSE evaluates the

acceptability of safety cases, by setting out the principles against which cases are assessed,

with explanations of what is required.

Safety cases should take account of each principle to the extent necessary to provide an

adequate demonstration, and also include the factual information required by OSCR.

APOSC complements the guidance on the Regulations. They should be read together.

The three principal matters to be demonstrated in a safety case are that:

1. The management system is adequate to ensure compliance with statutory health and

safety requirements; and for management of arrangements with contractors andsub-contractors.

2. Adequate arrangements have been made for audit and for audit reporting.







http://www.hse.gov.uk/offshore/aposc190306.pdf













3. All hazards with the potential to cause a major accident have been identified, their

risks evaluated, and measures have been, or will be, taken to control those risks to

ensure that the relevant statutory provisions will be complied with.

In the following pages we will look at the specific contents of a safety case which includes:

Factual information on the facility.

Details of the management system.

Demonstrate that all major accident hazards have been identified, evaluated, and

controlled.

How major accident risks are managed.

Provisions for rescue and recovery.

Consideration of the facility's lifecycle, from design to decommissioning.

Demonstration of how safe design principles and inherent safety have been included

in the design of the installation.

The safety case should be available to anyone on the installation who wishes to look at it.

4.5 - Offshore Safety Case Content - Factual Information.

The safety case will include factual information about the installation itself, the plant and

systems used, the location and external environment. It should also cover the activities to

be carried out on, or in connection with, the installation. Each piece of information will be

linked to all identified hazards associated with the information and which have the

potential to cause a major accident.

Other information includes:

Name and address of the operator of the installation.

Summary of how the employee safety representatives for that installation were

consulted with regard to the preparation (or revision) of the safety case.

A description, with suitable diagrams, of:

o The main and secondary structure of the installation and its materials.

o Its plant.

o Its layout and configuration of its plant.

o The connections to any pipeline or installation.

o Any wells connected or to be connected to the installation.

o The types of operation, and activities in connection with the operation, which

the installation is capable of performing.

o The maximum number of people expected to be on the installation at any

time, and for whom the accommodation is to be provided.

4.6 - Offshore Safety Case: Details of the Safety Management System.














The safety case should show how the management system will apply appropriate levels of

control during each phase of the installation's lifecycle. This will include the design,

construction, commissioning, operation, decommissioning and dismantlement stages.

The safety case should include the following elements in the descriptions of the

management system in order to demonstrate that the system is adequate:

Policy setting:

o Outlining the policy and its objectives.

o Demonstrating corporate acceptance of responsibility.

Organisation:

o The structure of the organisation.

o Demonstration of its accountability.

o Demonstration of its safety culture.

o Demonstration of how professional and safety advice will be shared.

o Demonstration of how the workforce will be encouraged to be involved.

o Outlining of the risk assessment systems.

Planning and standards:

o Outlining the standards and the procedures for controlling risks, including

workload and working hours.

o Outlining the permit to work system and where it will be applied.

o Outlining how competency and training will be implemented.o Outlining how key personnel will be selected.

o Outlining how changes will be controlled.

o Outlining how contractors will be selected and controlled, including

subcontractors.

o Outline the planning and control for emergencies.

o Outlining how occupational health will be managed.

Performance measurement:

o Outlining how the recording and investigation of incidents will be

implemented.o Outlining how active monitoring will be implemented.

Audit and review:

o Outlining the auditing process.

o Outlining when and how any review will be applied and the process for

learning lessons.

The safety management system should clarify who is in charge of activities during normal

operating conditions and in emergency situations. This would include the arrangements for

communications between the 'responsible persons' both on and offshore.














The safety management system should take account of:

The levels of authority.

Performance standards.

How to deal with exceptional conditions.

Any lessons learnt from previous incidents.

In the situation where an installation is working in combination with another installation or

vessel, the safety case should summarise any arrangements which have been put in place

to coordinate both parties.

4.7 - Offshore Safety Case Content: Management of Major Risks and Hazards.

Identification, Evaluation, and Control of Major Risks andHazards.

The safety case will show how a systematic process has been used to identify all reasonably

foreseeable major accident hazards that are applicable to the installation. This will include

identifying the initiating events or sequences related to those identified hazards.

The safety case should demonstrate that all hazards with the potential to cause a major

accident have been identified, their risks evaluated and that measures have been taken to

control those risks.

The safety case will clearly show what criteria have been adopted for major accident risk

assessment, including the methods used and the evaluation process applied. They will

include:

That particular attention has been paid to instances or areas that have been

identified where people may be exposed to significantly higher risks in comparison to

the installation as a whole.

How the evaluation has considered people as both a key element in safe operation as

well as a potential cause of major accidents and their escalation.

That adequate considerations of uncertainty has been taken into account when

presenting quantitative and qualitative risk assessment arguments.

That the relative merits of engineering judgement and good practice have been

adequately considered.

That the process of identifying risk reduction measures is systematic and takes into

account new knowledge. Furthermore, what the reasoning was behind the choice of

risk reduction measures. That proposed measures to reduce risk have timescales applied.














Major Accident Risk Management.

The safety case should describe what measures will be taken to manage major accident

hazards. These will include:

An explanation as to how inherently safer design concepts have been applied in the

decision-making process relating to design.

What measures are in place to prevent major accident hazards during the

installation's current phase of operation and the activities associated with it.

What measures are provided for detecting events that require an emergency

response.

What control and mitigation measures will be provided to protect personnel from the

consequences of a major accident. Also, how they will take account of likelyconditions during an emergency. Finally, what measures and arrangements have

been made for managing an emergency.

What arrangements have been made to ensure that the Temporary Refuge will

provide sufficient protection to enable people to muster safely.

What arrangements and provisions have been made to ensure that the integrity of

the Temporary Refuge is not compromised by any of the hazards identified in the risk

assessment. Also, how long this integrity has been designed to be maintained for.

Demonstrate that the evacuation and escape arrangements have been integrated in

a logical and systematic manner. Also, that they take into account the potential worst

environmental conditions in which they may need to be undertaken.

Rescue and Recovery.

The safety case should demonstrate that effective rescue and recovery arrangements have

been planned for to cope with major accidents.

Combined Operations.

The safety case should demonstrate how the management system addresses the additional

risks associated with combined operations, including:

The arrangements in place for coordinating the management systems of all duty

holders involved in any combined operation.

The arrangements in place for a joint review of the safety aspects of any combined

operation by all duty holders involved, which shall include the identification of

hazards with the potential to cause a major accident and the assessment of riskswhich may arise during any such operation.














The plant likely to be used during any combined operation.

Specific Examples of Arrangements.

Arrangements would normally include:

The arrangements for the control of well operations, including those to:

o Control pressure in a well.

o Prevent the uncontrolled release of hazardous substances.

o Minimise the effects of damage to subsea equipment by drilling equipment.

A description of the arrangements made for protecting people on the installation

from toxic gas.

A description of the measures or arrangements for the protection of people on theinstallation from the hazards of fire, heat, smoke, toxic gas, or fumes, including the

arrangements for people to be evacuated from the installation. This would include:

o Temporary refuges.

o Emergency routes and evacuation points.

o Means of evacuation from the installation.

o Facilities within the temporary refuge for the monitoring and control of the

incident and for organising evacuation.

4.8 - Offshore Safety Case Content: Lifecycle Requirements.

The safety case should include a design notification, which describes how the principles of

risk evaluation and risk management are being applied to the design to ensure that major

accident risks will be controlled. This should include well engineering aspects, especially

those that refer to well operations before the start of the facility operations.

Safe Design Concept.

The safety case is required to include an explanation of how inherently safe design

concepts were considered and applied. This requirement not only applies to when the

installation was at the design stage, but also at other stages in the life of the installation.

In order to ensure an inherently safer design, the design process should incorporate at a

very early stage a hazard management strategy. This should include consideration of:

The concept selection, for example:

o A platform or subsea development?

o Attended or unattended wells?

o Floating or fixed wells?

o Multiple or single structures?













4.8 - Offshore Safety Case Content: Lifecycle Requirements.

Where the installation should be located and its orientation.

The substitution of hazardous substances and processes by less hazardous ones.

The segregation of hazards.

Reducing the complexity of the design.

The reduction of subsea uncertainty (for example, the use of seismic surveys).

The location and routing of the riser.

Making allowances for human factors (for example, by designing in fail-safe features).

The selection of materials.

The corrosion, erosion, and stress concentration in the design.

How the design can allow for inspection and maintenance.

Decommissioning and Dismantlement.

When the installation is reaching the end of its working life, the safety case will have to be

revised to deal with decommissioning or dismantlement operations. At that point the safety

case revision will include a description of the sequence of events from cessation of

production to dismantling of the structure. The safety case will also include a description of

the extent and availability of safety systems during decommissioning or dismantlement

operations.

Any major accident hazards identified from the decommissioning or dismantlement

operations will be identified in the safety case, as well as how the management system willmaintain effective control during these periods.

4.9 - Onshore Safety Reports.

The safety report will be assessed by the enforcing authorities and evaluated to ensure it

meets the requirements of the legislation.

The safety report is split into five main sections:

Descriptive information. Information on management measures to prevent major incidents.

Information on potential major incidents.

Information on measures to prevent or mitigate the consequences of a major

incident.

Information on the emergency response measures of a major incident.

In the following pages we will look at these sections in more detail.

4.10 - Onshore Safety Report Contents: Descriptive Information.













4.10 - Onshore Safety Report Contents: Descriptive Information.

Overview of the Facility and its Activities.

The overview will give a general outline of the installation itself, what activities are carried

out, and what products it uses and produces. It will also include the identified majorincident scenarios and the measures in place for protection and intervention.

Information about Dangerous Substances in Use at the

Facility.

This will show:

The maximum quantities of dangerous substances likely to be present on the site atany time.

The chemical name of each and every type of dangerous substance involved in the

process system.

The physical and chemical behaviour and/or characteristics of each type of

dangerous substance including, where relevant:

o Flash point.

o Flammable limits.

o Vapour pressure.

o Density etc. The potential harm, either immediate or delayed, which could be caused by these

dangerous substances. For example:

o Asphyxiant.

o Flammable.

o Harmful to the environment etc.

Information about the Surrounding Environment.

A description of the surrounding environment including use of the land or activities

conducted on the surrounding land, the extent and location of population, the location of

significant buildings and infrastructure (for example, hospitals, schools, road networks,

etc.), and water extraction points.

A map of the area usually forms part of this section. This will also show the extent of the

area to be affected by the worst case scenario.

4.11- Onshore Safety Report Contents: Information on Management Measures to Prevent

Major Incidents.













4.11- Onshore Safety Report Contents: Information on Management Measures to Prevent

Major Incidents.

Major Accident Prevention Policy (MAPP).

The COMAH Regulations require UK based onshore facilities to produce a Major AccidentPrevention Policy. The MAPP sets out the policy on the prevention of major accidents and it

should outline the following:

Description of the Safety Management System.

Roles and responsibilities of all key personnel.

Training requirements to maintain competency levels and correct any shortfalls in

competency.

Hazard identification and risk assessment process.

Procedures and instructions for the safe operation of plant. Design and any subsequent modification of the site.

Identification of all foreseeable emergency scenarios and preparation for them.

Accident investigation procedures.

How compliance will be measured.

Review and audit frequency and procedures.

When, and under what circumstances, the MAPP will be updated.

4.12 - Onshore Safety Report Contents: Information on Potential Major Incidents.

This section describes the processes and scenarios that could lead to a major incident

occurring. This will include details about the processes, the areas of the facility likely to be

affected, and the scenarios identified as plausible.

4.13 - Onshore Safety Report Contents: Information on Measures to Prevent or Mitigate

the Consequences of a Major Incident.

This section describes the facility, the plant, and the equipment in the context of how major

incidents can be prevented or mitigated. This will include details on operating parametersand what measures are in place to ensure they are not exceeded, emergency shutdown

elements, detection equipment, firefighting arrangements, emergency evacuation and

temporary arrangements, etc.

All these elements will be categorised into either:

Inherent safety measures.

Prevention measures.

Control measures.

Limitation measures.













4.14 - Onshore Safety Report Contents: Information on the Emergency Response

Measures of a Major Incident.

Onsite Emergency Plan.

This section describes the protection and intervention measures which are included in theonsite emergency plan. This will include:

What equipment there is to limit the consequences of a major incident.

What arrangements there are for alerting and intervening in an emergency.

What onsite and offsite resources are available.

What arrangements have been made to ensure all the resources and other

equipment are maintained to an acceptable standard.

What arrangements there are for the training of personnel in emergency response.

What arrangements there are for testing of the emergency plan.

Offsite Emergency Plan.

This section describes the arrangements for involving external emergency services and

agencies. This will include:

Details of the site including its location, roads, and access points.

A site plan showing key facilities such as control centres, medical centres, main

process plants, and storage areas.

Details of site personnel.

Details of offsite areas likely to be affected by a major incident as well as levels of

harm or damage possible. This will include the type of buildings, population density,

sensitive buildings, drainage details etc.

Details of dangerous substances on site including the types of substances, quantities,

hazardous properties, location etc.

Details of any relevant technical advice.

Details of equipment and resources that are available for firefighting purposes. The function of key posts with duties in an emergency response, their location and

how they can be identified.

An outline of the initial actions to be taken in case of an emergency situation, such as

warning the public, setting up emergency facilities such as a control room etc.

4.15 - Auditing Safety Cases and Safety Reports.

According to the HSE an audit means "a systematic assessment of the adequacy of the

management system to achieve its purpose, carried out by persons who are sufficientlyindependent of the system (but who may be employed by the duty holder) to ensure that













4.15 - Auditing Safety Cases and Safety Reports.

such assessment is objective.

Under OSCR and COMAH, organisations have duties to audit their safety cases and safety

reports.

The frequency and scope of the audits is to be decided by the organisation and will depend

on the level of risk. However, the audit plan will come under scrutiny by the enforcing

authority and therefore will have to be deemed satisfactory.

In addition to carrying out audits, OSCR also imposes duties on offshore organisations

regarding audit reports.

A copy of the audit report shall be kept at the head office and onboard the

installation.

A written statement shall be prepared recording:

o The main findings of the report.

o The recommendations of the report.

o The action proposed to implement those recommendations, including the

timescales involved.

Ensure that a record is kept of any action taken in consequence of an audit report,

and a copy of that record kept at the head office and on the installation.

Audit reports and associated records shall be kept for at least 3 years.

Question 12.

Is the below statement True or False?

'A safety case is required for all onshore oil and gas installations.'

4.16 - Example Exam Questions.

Here are sample exam questions that NEBOSH has asked. Again, there is no guarantee that

these questions will be repeated in the future. But it will give you a flavour of the types of

questions asked on this subject.

1. Safety case documents offshore and safety report documents onshore contain similar

information requirements.

(a) Identify these similar information requirements. (4)

(b) Outline the reasons for using these documents. (4)













4.16 - Example Exam Questions.

2. In the case of a safety report:

a) Outline the typical contents of an onsite emergency plan. (4)

b) Outline the typical contents of an offsite emergency plan. (4)

4.17 - Summary.





About the documented evidence required for onshore and offshore installations.

What the above evidence is used for.

The typical contents of safety cases and safety reports.

Auditing requirements of Safety Cases.











SHEilds – General Contacts

SHEilds UK

SHEilds House24 Priory Tec ParkSaxon WayHessleHullHU13 9PB

Tel: 0845 122 3408Intl: +44 (0) 1482 806 805Email: [email protected]

SHEilds FZ-LLC

Block 19Office 204Knowledge VillageDubaiPO Box 501725

Tel: +971 4 3754012

Email: [email protected]

Safety Training India Mumbai

Office No. 305, Third Floor, Sangeet Plaza,Near to Marol Fire Brigade,Marol-Maroshi Road,

Marol Naka, Andheri (E),Mumbai 400 059India

Tel: +91 (0) 22 3222 6805Tel: +91 (0) 72 0830 6494

Safety Training IndiaHyderabad

8-1-21/144/1, Flat No 301Rismy Towers, Surya Nagar ColonyTolichowki X RoadsNear Orange Honda ShowroomHyderabad - 500008, A.P

Tel: +91 (0) 40 6464 0660Tel: +91 (0) 98 8575 7517Email: info@safetytraining co in

mailto:[email protected]













Documents

IOG Element1