Functional Safety Inspection Guide

Offshore Major Accident Regulator • Offshore Petroleum Regulator for Environment & Decommissioning

The Offshore Functional Safety Inspection Guide

Open Government Status Fully Open Publication Date 01/04/2024 Review Date 01/04/2027

Review History Date Changes

01/03/2023 Revision A – For Comment 11/05/2023 Minor updated to include JP Comments 28/08/2023 Minor update to include EC&I Team Comments 26/01/2024 Updates following external stakeholder consultation 21/02/2024 Revision 0 – Approved for Use

Contents

Summary..........................................................................................................................................3 Introduction ......................................................................................................................................3 Relevant Legislation, Standards and Guidance ...............................................................................3 Action...............................................................................................................................................4 Background......................................................................................................................................8 Other relevant Inspection Guides.....................................................................................................8 Specialist Advice..............................................................................................................................9 Organisation.....................................................................................................................................9 Recording & Reporting.....................................................................................................................9 Appendix 1 – Typical Inspection Information Request ................................................................... 11 Appendix 2 – Typical Inspection Agenda ....................................................................................... 12 Appendix 3 – Functional Safety Management................................................................................ 14 Appendix 4 – SIS Design ............................................................................................................... 19 Appendix 5 – SIS Installation Commissioning and Validation ........................................................ 26 Appendix 6 – SIS Operation & Maintenance.................................................................................. 28 Appendix 7 – SIS Management of Change .................................................................................... 33 Appendix 8 – Application of the EMM and Dutyholder Performance Assessment ......................... 35 Appendix 9 – Functional Safety Assessment Framework (FSAF).................................................. 37

Summary This IG outlines an approach to the inspection of the duty holder’s arrangements with respect to Functional Safety and the key areas that inspectors should consider when inspecting this topic (with respect to safety or environmental integrity). It also sets out the criteria for satisfactory and unsatisfactory performance factors against which duty holder performance will be rated. Reference is made to technical standards and guidance that inspectors will use to form an opinion of legal compliance.

Introduction The purpose of this Inspection Guide is to provide information and guidance to all OMAR Inspectors within ED Offshore to support the delivery of consistent and effective inspection of duty holder arrangements to comply with established benchmarks but is particularly aimed at ED Specialist Inspectors. See specialist advice section, below.

This guide highlights key areas for inspection and provides a framework against which inspectors can judge compliance, assign performance ratings and determine what enforcement action should be taken with respect to legislative breaches that may be found.

Relevant Legislation, Standards and Guidance

Relevant Legislation • Offshore Installations (Offshore Safety Directive) (Safety Case etc.) Regulations 2015

• Offshore Installations (Prevention of Fire and Explosion, and Emergency Response) Regu- lations 1995 Regulation 5, 9 and 19

• Management of Health and Safety at Work Regulations 1999 Regulation 3 and 5

• Provision and Use of Work Equipment Regulations 1998 Regulation 5 and 6

Technical Standards • IEC 61508:2010, Parts 1-7: Functional Safety of Electrical/Electronic/Programmable Elec- tronic Safety-Related Systems • IEC 61511:2017, Parts 1-3: Functional Safety – Safety Instrumented Systems for the Process Industry Sector • IEC 62061:2021 Safety of Machinery – Functional Safety of Safety Related Control Systems • IEC 62443, Parts 1-4: Security for Industrial Automation and Control Systems • BS EN 62682:2015 Management of Alarms Systems for the Process Industries

• BS EN ISO 10418 Petroleum and natural gas industries – Offshore production installations - Process safety systems • API RP 14C – Recommended Practice for Analysis, Design, Installation and Testing of Basic Surface Safety Systems for Offshore Production Platforms

Industry Publications • EEMUA 222: Guide to the Application of IEC 61511 to Safety Instrumented Systems in the UK Process Industries • IOGP Report 636: Supplementary Specification to IEC 61511- Safety instrumented systems for the process industry sector. • CDOIF Guidance document: Functional Safety Management of Installed Safety Instrumented Systems • CDOIF Guidance document: Demonstrating prior use of elements of a safety instrumented function in support of IEC 61511 • ISA-TR84.00.09-2017: Cybersecurity Related to the Functional Safety Lifecycle • EEMUA 191, 3rd Edition: Alarm Systems – A guide to design, management and procurement • Energy Institute: Guidance on Safety Integrity Level (SIL) Determination

Relevant HSE Guidance • OG46 Management of Instrumented Systems Providing Safety Functions of Low / Unde- fined Safety Integrity • OG47 Operator Response within Safety Instrumented Systems in the Chemical (Onshore), Oil & Gas (Offshore), and Specialist Industries • OG54 Proof testing of Safety Instrumented Systems in the Onshore Chemical / Specialist Industry • OG86: Cyber Security for Industrial Automation and Control Systems (IACS) • SPC/Tech/OSD/31 Safety Instrumented Systems for the Overpressure Protection of Pipe- line Risers • Managing Competence for Safety-Related Systems, Part 1 – Key Guidance and Part 2 – Supplementary Material

Action Inspectors should draft an agenda and request relevant documentation to support the functional safety inspection. Appendix 2 shows a typical inspection agenda for a functional safety inspection. It also provides guidance notes on which appendices are likely to be relevant. Appendix 1 outlines the relevant inspection information that should be requested ahead of the inspection. It also lists the

typical documentation that will be reviewed during the onshore and offshore parts of the inspection. Inspectors should review relevant documentation prior to the installation visit and test compliance during the installation visit against the success criteria detailed within Appendices 3 – 7. The results of this should be recorded in the Functional Safety Assessment Framework (FSAF) document which will in turn generate an inspection score based on the inspectors’ findings and give an indication of the initial enforcement expectation, in line with the requirements of the EMM. See appendix 8 for more detail. Appendix 9 shows extracts from the FSAF and a CM9 reference to the live document. The initial enforcement expectation will then have to be tested and adjusted in line with the dutyholder and strategic factors considerations, as outlined in the EMM.

The score which is automatically generated is based on the highest degree of non-compliance identified while completing the FSAF. If the highest recorded score is 20, meaning that the dutyholder is deemed to be fully compliant against the requirements of all of the success criteria against which were assessed, the score will default to 10. The final score is entered manually by the inspector. This will allow them to escalate the score and subsequent initial enforcement expectation as required. For example if multiple sections produce a score of 30 then the inspector may choose to give an overall score of 40, in line with the Energy Division document Inspection Scoring Guidance.

The score should be used to determine the initial enforcement expectation using the table in Appendix 8. Duty holder and strategic factors should then be applied in line with the requirements of the EMM.

By the conclusion of the inspection, it should be possible to: • Understand and evaluate the approach the Duty Holder has taken to Functional Safety; • Identify any deficiencies in this approach that are not in line with current standards and good practice; • Identify enforcement action required to bring the approach in line with current standards and good practice.

When carrying out inspections covered by this IG, inspectors should: • Assess duty holder’s level of compliance against the success criteria in the FSAF. These success criteria are also included in Appendices 3 – 7, along with relevant background infor- mation. • Use the FSAF to - o determine the appropriate performance rating; and

o determine the initial enforcement expectation; and o consider how and when the issues raised during an inspection are to be closed out.

The flowchart shown in Figure 1, below, gives an overview of the inspection process.

Figure 1 - Inspection Process Flowchart

Draft Agenda and Request Doruments

Pr e-Inspection Document Review

Onshore Inspectio n • Select M AH Scenario and 0:fine SampleSIF

NO

Consi der assessing against the r equirements of Appendix Sand/ or 7 whet e applicabl e.

Assess ag3inst the r equirements of Appendix 3,4 and 6 using FSP.F Obj@ ctiv~ A,8 and 0, .u appropriate.

Comp!a-te th e r ele-vant FSAF sections as appropriate for the inspection.

For information on possible adjustem ents to scoring, see Inspection Scoring Guidance.

NO h rrps:jjhsegov.shor epoinr.com/sit es/ foergyDivisionUnit:5/ Sit ePogesjlnspectfon- Scoring-Guidonce-{Extracr-f rom-ED- lnspecrion-Gvide-Template}.aspx

Enter the scot e into the Inspector's Enter adj usted store into score box. inspector's score box.

R-?Cord initial enforcem ent expectation from the f SAF

Apply dutyholdet and strategic fa:ctot s from the :::MM

Take r el evant enfot cem ent action wher e applicable and comp!a-te inspection report.

Figure 1: Inspection Process Flow Chart

Background The correct design of Safety Instrumented Systems and ongoing management of these during maintenance and operation phases is a key component in the suite of measures taken to minimise risk and prevent the occurrence of hazardous events with potential impact to personnel or the environment. This guide will ensure that Functional Safety Inspections are conducted in a consistent manner, and will gauge a duty holder’s compliance with the reference standard, BS EN 61511.

Other relevant Inspection Guides

• Inspection of Loss of Containment (LOC) This IG provides more detailed information on the design and operation of phases which are fundamental to the adequate implementation of a robust approach to Functional Safety, such as:

o Process Plant Design – including Hazard and Operability Study (HAZOP), Safe Operating Limits, Process Safety Time. o Management of Safe Operating Limits. o Alarm Management. o Over-rides and Inhibits. o Other prevention measures (relief, blowdown and flare).

• The Offshore Audit, Monitoring and Review Inspection Guide This IG provides more detail on the requirements for inspecting policies and procedures which form part of the duty holder’s safety management system. This guide should be followed when assessing the suitability of the functional safety audit, defined in BS EN 61511-1.

• Inspection of Maintenance Management This IG provides further details on the maintenance management aspects of Instrumented Protection Systems.

• Cyber Security for Industrial Automation and Control Systems (IACS) Inspection Guide This IG provides details on how cyber security risk management would be inspected. See Appendix 4 (SIS Design)

• Operational Risk Assessment This IG provides details on how to manage risk during abnormal conditions. It may be useful when assessing scenarios where SIF components are not functioning as designed.

Specialist Advice Specialist advice should be sought from ED5 – Electrical & Control Systems Team for any support required to enforce on any element contained in this guide, or any clarification required in the compliance demonstration made for any relevant provision.

Organisation

Targeting Inspections should be planned within the timescales set out by ED divisional management, and should be targeted at duty holders identified as having the greatest risk gaps. This defined as part of the ED inspection planning and duty holder strategy processes.

Timing Inspections should be undertaken as part of the agreed Intervention Plan, or as determined by the Energy Division Senior Leadership Team (EDSLT)

Recording & Reporting The duty holder performance ratings should be entered on the Inspection Rating (IRF) Tab of the relevant installation Intervention Plan Service Order. Findings should be recorded in the post inspection report and letter.

Glossary of Terms

BPCS Basic Process Control System C&E Cause and Effect Diagram CDOIF Chemical and Downstream Oil Industries Forum CMMS Computerised Maintenance Management System CPU Central Processing Unit EC&I Electrical Control and Instrumentation ED Energy Division EDSLT Energy Division Senior Leadership Team EMI Electromagnetic Interference EMM Enforcement Management Model FSA Functional Safety Assessment FSAF Functional Safety Assessment Framework FSMP Functional Safety Management Plan HAZOP Hazard and Operability Study HSE Health and Safety Executive IG Inspection Guide IPL Independent Protection Layer LOC Loss of Containment LOPA Layer of Protection Analysis MAH Major Accident Hazard MOC Management of Change OMAR Offshore Major Accident Regulation ORA Operational Risk Assessment P&ID Piping and Instrumentation Diagram PFD Probability of Failure on Demand PFDavg Average Probability of Failure on Demand QA Quality Assurance QC Quality Control RFI Radio Frequency Interference RRF Risk Reduction Factor SIF Safety Instrumented Function SIL Safety Integrity Level Note: This term is also used to account for Integrity Level of SIFs which protect against environmental hazards. Sometimes referred to in industry as EIL. SIS Safety Instrumented System SRS Safety Requirements Specification

Appendix 1 – Typical Inspection Information Request

Prior to any Functional Safety inspection, the following documents should be requested as a minimum:

• Functional Safety Policies & Procedures which include - o how functional safety is managed throughout each stage of the SIS lifecycle; and o how roles, responsibilities and competence are defined; and o how SIS data, such as equipment details, trip settings, software backups and key lifecycle documents, are managed; and o how hazard & risk analysis and SIL allocation is conducted; and o verification and Validation arrangements; and o performance monitoring; and o how inhibits and overrides are managed; and o alarm management strategy; and o how modifications SIS are managed. • Functional Safety Management Plan (FSMP). • Safety Instrumented Function (SIF) Register. • Independent Protection Layer (IPL) Register. • Any available Functional Safety Assessment (FSA) Reports. • Detail of any Functional Safety Audits that have been carried out.

Once a selection of sample SIFs to be inspected has been chosen, the following documents specific to that SIF should be requested:

• P&IDs for each SIF; • Cause & Effect Drawings for each SIF; • Latest HAZOP Report; • LOPA (or equivalent) for each SIF; • Safety Requirements Specification for each SIF; • SIL Verification Report • Proof Test Procedure for each SIF. • SIF Inspection procedure (If not combined with the proof test).

Appendix 2 – Typical Inspection Agenda

Agenda Template

1. Review of EC&I Inspection Strategy (MAH Scenario)

HSE explanation of the MAH strategy for inspecting Functional Safety by assessing the barriers invoked by a hypothetical MAH scenario, including -

• a sample of safety instrumented functions; and • relevant layers of protection

2. Discussion and selection of sample SIF to be used for the MAH scenario. Using SIL register, SRS, functional safety related ORA, P&IDs, C&Es etc.

3. Based on SIF chosen from MAH initiating event, inspection of the EC&I systems, documents, and drawings to assess the level of compliance with the following sections of the ED Inspec- tion Guide for Offshore Functional Safety:

• Appendix 3: Functional Safety Management (FSAF - Objective A) • Appendix 4: SIS Design (FSAF – Objective B) • Appendix 5: SIS Installation, Commissioning and Validation (FSAF – Objective C) • Appendix 6: SIS Operation and Maintenance (FSAF – Objective D) • Appendix 7: SIS Management of Change (FSAF – Objective E)

Inspector Notes for Onshore Inspection The inspection will be based on relevant section of the Functional Safety Assessment Framework (FSAF). During the onshore inspection a sample of SIFs will be selected. Based on the sample selected, the relevant sections of the FSAF will be selected. For example a SIS which has been in operation for a number of years the following sections are likely to be most relevant:

• Objective A: Functional Safety Management • Objective B: SIS Design • Objective D: Operation and Maintenance

Where a SIS of SIF have been recently installed or where a modification has been carried out, the following objectives may also be relevant:

• Objective C: SIS Installation, Commissioning & Validation • Objective E: SIS Management of Change.

Inspector Notes for Offshore Inspection The offshore Functional Safety inspection will confirm the detail of any onshore findings and/or discussions. It will involve conversations with, and access to, as a minimum -

• the lead instrument technician; and • the maintenance supervisor; and • the control room operator; and • technicians responsible for carrying out SIS testing and maintenance.

Note: other identified personnel with responsibility and accountability may also be required dependant on the aspects of the guide which are being used. E.g. OIM etc.

Appendix 3 – Functional Safety Management

Lifecycle Management Duty holders must have policies and procedures which describe how they will manage instrumented systems used to prevent major hazards. BS EN 61511 outlines a lifecycle approach to the management of functional safety. While it is not mandatory to follow this particular standard it is seen as an industry benchmark. The lifecycle process set out in the standard follows a logical approach and establishes requirements which are based on good engineering practice. Whether BS EN 61511 is adopted or not, duty holders must be able to demonstrate how they effectively manage functional safety in a way that is equivalent to BS EN 61511. This could be achieved by adopting an alternative UK standard. For example, BS ISO 10428 outlines a process for combining the BS EN 61511 and API RP 14C approaches to allow management of major accident hazards in line with the requirement of BS EN ISO 17776. Whichever standard is followed, it must be possible to demonstrate that the risks associated with each SIF are ALARP. Given that many aspects of compliance with BS EN 61511 do not require significant capital expenditure, this cannot only be achieved through cost benefit analysis.

The duty holder should have an audit process in place to review the policies, procedures and other key documentation to ensure it is fit for purpose and to assess compliance. Verifying that the policies and procedures are fit for purpose should involve an independent review of the policies and procedures against the requirements of BS EN 61511. This should be repeated each time BS EN 61511 is updated or there are significant modifications to policies and procedures. The compliance assessment should be carried out at an appropriate frequency, this will likely be defined by the duty holder’s corporate requirements for safety management system compliance audits. There should be a suitable degree of independence between the people who lead the audit and those involved in related lifecycle activities. Common practice in industry is to use an organisation that is independent from those involved in the related lifecycle activities. If this is not the case then the dutyholder must be able to justify the reduced level of independence for functional safety audits, with specific reference to BS EN 61508, table 5. Note, this requirement for independence also applies to functional safety assessments and verification activities, although in some instances BS EN 61508 table 4 may be more appropriate.

Note, some schemes are available which allow the duty holder to verify that their functional safety management system meets the requirements of BS EN 61511. One example being the CASS scheme, which is operated by the 61508 association.