Loss of Containment (LoC) - Version 2 March 2018

ED Inspection Guide Offshore Inspection of Loss of Containment (LOC) Open Government status: Fully Open

Target audience: HSE ED Inspectors

CONTENTS  Summary  Introduction  Action  Background  Applicable Legislation  Contacts  Appendix 1: Process plant design, construction and commissioning  Appendix 2: Process plant operation within safe limits  Appendix 3: Instrumented Protection Systems  Appendix 4: Relief, blow-down and flare systems  Appendix 5: Process isolations  Appendix 6: Plant re-instatement following maintenance or idle phase  Appendix 7: Management of change  Appendix 8: Other offshore process hazards  Appendix 9: Monitoring and review arrangements  Appendix 10: Positive process safety culture  Appendix 11: Floating production, storage and offloading (FPSO) Installations  Appendix 12: Management of small bore tubing, piping and flexible hoses  Appendix 13: Duty holder performance assessment

SUMMARY

This document is intended to provide guidance to Energy Division staff to support inspection of loss of containment risk at offshore oil and gas installations. It describes a number of key elements which contribute to effective management of the risks, based on research into root causes of previous incidents, and published industry codes, standards and good practice. It also identifies relevant legislation, matters of evident concern, benchmark standards and examples of good practice for each element, in order to support performance assessment. Areas where additional specialist support may be useful or necessary are identified.

It is important to note that the guide does not cover a number of aspects which are fundamental to management of loss of containment risk, where the technical lead is taken by other HSE specialist teams, and/or other inspection guidance exists. This includes for example the design, inspection and maintenance of pressure systems, control of work (including permit to work) and several human factors topics.

INTRODUCTION

The aim of this Inspection Guide (IG) is to provide information and guidance to offshore inspectors to support the delivery of consistent and effective inspection of process safety systems which protect against loss of containment. It does this by highlighting current key areas to be covered during inspections, providing a framework for inspectors to judge compliance, assign performance ratings, and decide what enforcement action to take should they find legislative breaches. In doing so, it complements HSE’s Enforcement Policy Statement (EPS) and Enforcement Management Model (EMM).

Various regulations (described more specifically later) place duties on operators of offshore installations to take measures to minimise the risk of a loss of containment of flammable, toxic or hazardous substances. These measures must be effective throughout the installation’s lifecycle, and under all foreseeable plant conditions

This guide is split into twelve core intervention areas as follows:

1 Process Plant design, construction and commissioning 2 Process Plant operation within safe limits 3 Instrumented Protection Systems 4 Relief, Blow-down and Flare systems 5 Process Isolations 6 Plant Re-instatement following Maintenance or Idle Phase 7 Management of Change 8 Other Offshore Process Hazards 9 Monitoring & Review Arrangements 10 Positive Process Safety Culture 11 Floating Production, Storage and Offloading (FPSO Installations) 12 Management of small bore tubing, piping and flexible hoses

An overview of each of the above will be provided in appendices 1-12. The effectiveness of the measures taken under each area is key to ensuring that a duty holder minimises the likelihood of a major accident hazard occurring. Appendix 13 provides generic guidance on assessing duty holder performance using the inspection guide.

ACTION

A complete inspection of this topic requires all intervention areas to be addressed, although some may be of greater relevance to a particular installation given its inherent hazards, performance history and position within its own lifecycle. For the purposes of assessing the performance of a duty holder, the scope of the intervention areas to be inspected should be agreed in advance between the IMT and other specialist inspectors assigned. Individual appendices provide detail on relevant standards and good practice that are expected in general terms, but inspectors will need to devise suitable question sets and other inspection approaches to assess the level of compliance against the quoted benchmarks, based upon the scale and nature of hazard at particular installations.

BACKGROUND

ED’s main concern is the prevention of major hazard incidents, in which workers are killed or injured. Major fires and explosions, such as those that occurred on Piper Alpha and Macondo (Deepwater Horizon), have been initiated by releases of hydrocarbons. As such, the effective design and implementation of measures to prevent such losses of containment is fundamentally important.

Typical sources of hydrocarbon releases (HCRs) are the well, the pipeline riser, other pipelines and pipe work and associated process plant. Releases can occur from either failure of the asset itself due to corrosion, abrasion or fracture, or because of failures of maintenance e.g. poor practice when breaking and re-making joints, or insufficient operational controls. HCRs can also result from damage due to other failures e.g. dropped objects during crane operations.

TARGETING

Inspections should be planned within the timescales set out by ED divisional management. Although inspections may be carried out at any installation, it is particularly important to carry this out where there are known issues that may affect process integrity, such as ageing equipment, major work over projects etc. It is essential to ensure that duty holders are robust in their assessment of the implications of these factors, that suitable mitigations are in place and that cumulative risk factors have been considered.

TIMING

Inspectors should undertake loss of containment interventions as part of the agreed ED offshore intervention plan, when intelligence indicates intervention is necessary, or when investigation due to incident is required.

RESOURCES

ED3.1 (Process Engineering) has overall ownership of the guide, and takes the lead on inspecting several of the elements. Some however are more closely aligned to other specialist teams (such as EC&I for appendix 3, and

Mechanical Integrity for appendix 12). Appendices 7, 9 and 10 describe inspection of particular process aspects of duty holders’ SEMS, and as such are closely aligned with IMT. Most of the elements will benefit from a multidisciplinary approach to their inspection.

RECORDING AND REPORTING

The duty holder performance ratings should be entered on the Inspection Rating Form (IRF) tab of the relevant installation Intervention Plan Service Order. Findings should be recorded in the normal post inspection report and letter.

APPLICABLE LEGISLATION

The table overleaf provides a cross reference of applicable legislation against the relevant sections of this inspection guide. All legislation is available to download from www.legislation.gov.uk. A list of applicable HSE publications, e.g. Approved Code of Practice, is also provided with these documents available from www.hse.gov.uk

SPECIALIST ADVICE

ED 3.1 can provide general/initial advice on all of the elements. Other units may however be able to provide additional or more authoritative guidance for particular aspects related to their discipline, as suggested below.

Appendix Title ED Unit Process Plant Design, Construction and 1 ED 3.1 Commissioning 2 Process Plant Operation within Safe Limits ED 1/ED 4.6 3 Instrumented Protection Systems ED 3.5 4 Relief, Blow-down and Flare Systems ED 4.1 5 Process Isolations ED 4.1 Plant Re-instatement following Maintenance or 6 ED 4.1 Idle Phase 7 Management of Change ED 1 9 Monitoring & Review Arrangements ED 1 ED 1/ ED 10 Positive Process Safety Culture 4.6 Floating Production, Storage and Offloading 11 ED 4.3 (FPSO) Installations Management of Small Bore Tubing, Piping and 12 ED 4.1 Flexible Hoses

Regulation Loss of Containment Guide Section 1 2 3 4 5 6 7 8 9 10 11 12 13 Control of Substances Hazardous to Health Regulations, 2002 Regulation 6 X Regulation 7 X Management of Health and Safety at Work Regulations, 1999 Regulation 3 X X X X X Regulation 4 X Regulation 5 X X X X X X X X X X X Regulation 10 X Regulation 11 X Regulation 13 X Offshore Installations (Prevention of Fire and Explosion, and Emergency Response) Regulations, 1995 Regulation 4 Regulation 5 X X X Regulation 9 X X X X X X X X X X X Regulation 10 X Regulation 12 X Regulation 19 X X X X X X Regulation 21 X Offshore Installations and Pipelines Works (Management and Administration) Regulations, 1995 Regulation 11 X X Offshore Installations and Wells (Design and Construction, etc) Regulations, 1996 Regulation 5 X Regulation 6 X Regulation 7 X Offshore Installations (Offshore Safety Directive) (Safety Case etc) Regulations, 2015 Regulation 7 X Regulation 8 X Regulation 32 X Provision and Use of Work Equipment Regulations, 1998 Regulation 4 X Regulation 5 X X X Regulation 6 X X X Regulation 8 X X X X X Regulation 9 X X X X Regulation 12 X Regulation 23 X X Note: that the Health and Safety at Work etc. Act 1974, Sections 2(1) and 3(1) outline the overarching duty and is applicable to all sections of this guide.

APPENDIX 1 – PROCESS PLANT DESIGN, CONSTRUCTION AND COMMISSIONING

Scope

This guidance applies to the inspection of systems which provide safety assurance for the design, construction and commissioning phases of offshore oil or gas production process plant.

A) PROCESS PLANT DESIGN

Fundamental Requirements

The design of a process plant is a complex activity that will usually involve many different disciplines over a considerable period of time. The design may also go through many stages from the original research and development phases, through conceptual design, detailed process design and onto detailed engineering design (drawings, calculations, specifications etc.) and equipment selection. Many varied and complex factors including safety, health, the environment, economic and technical issues may have to be considered before the design is finalised. At each stage it is important that the personnel involved have the correct combination of technical competencies and experience in order to ensure that all aspects of the design process are being adequately addressed.

The principles of inherently safer design are particularly important for major hazard plants and should be considered during the design stage where there is the greatest potential for reducing the risk of loss of containment, in an effort to reduce the hazard potential of the plant. Consideration should be given to processing hydrocarbons under conditions that make the materials less hazardous (e.g. at lower temperatures and pressures).

Consideration should also be given to complexity reduction where appropriate. Having a simpler design can also improve the overall safety of the plant because more complex plants may provide more opportunities for error in design, construction, commissioning and operation.

A number of principles should be adopted:

 Hazards and risks implicit in the design should be identified.  Engineering design should use a hierarchical approach to minimise risk (avoid, substitute, reduce, adapt, technical controls, procedural controls, and other measures which protect groups over those which protect individuals).  Appropriate and up to date industry standards should be used.  Equipment that is safety critical should be capable of maintaining its integrity throughout its life, taking account of normal as well as foreseeable extreme operating loads.  The materials used should be suitable for the process and the environment.

 All equipment that is safety critical should have adequate and defined reliability, availability and survivability.  The overall risk assessment and selection of options must have regard to the intended life cycle, including offshore construction, commissioning, operation, maintenance, foreseeable modifications and eventual decommissioning or disposal.

The opportunity to achieve an inherently safer design is greatest for new plant and equipment and wherever reasonably practicable, the same approach should be followed for plant modifications.

An example of inherent safety in design in the case of over-pressure hazards is that installations should preferably be designed to have fully rated risers, vessels, pipework and pipelines. If the topsides are not fully rated, a hierarchy of over-pressure protection measures should have been considered including: full flow relief; partial relief with instrumented protection system; HIPPS, etc.

Design for brownfield modification projects should follow the same general principles and such modifications should be subject to a management of change process where the risks should be identified and suitably assessed. Care should be taken when integrating new and old systems; it may not be reasonably practicable to fully upgrade an existing system as a result of a brownfield modifications. Justification of the boundaries of the modifications needs to be fully understood and assessed accordingly.

Hazard identification

Process risks, and loss of containment scenarios in particular, should be identified via installation specific hazard studies. These should be carried out in accordance with recognised standards or codes of practice, and include, but not be limited to, such studies as HAZOP, HAZID, Functional Safety assessment, SIL assessment, LOPA etc. The outputs of such studies should preferably be a full recording of the assessments made, rather than just a record of any issues or actions arising and confirmation that any issue or actions arising have been appropriately resolved. Full recording supports a demonstration that the process has been thorough, and ensures that any basis or assumptions are clear.

The hazard identification should involve the appropriate mix of disciplines/expertise in order to be effective and it is important to involve operations personnel who will be responsible for the day to day running and operation. Independent experts should also be involved. Where vendor supplied equipment is also present, these should be subject to the same hazard identification process as per the rest of the installation.

HAZOP and / or other safety studies should be carried out at the design stage though may be revisited during subsequent phases of the project. Action lists should be produced and an action tracking system set up. All actions should be closed out (i.e. completed & signed off) at an appropriate stage in the project lifecycle.

For additions to existing process plant, it is important that all factors affecting the existing plant have been identified and addressed and in some cases a new HAZOP may be required depending on the nature of the changes or additions.

Equipment Design

The mechanical design of vessels, pipework, pipelines and ancillary equipment has a critical impact on loss of containment risk. All equipment and systems which have the potential to cause or contribute to a MAH should be included. This area is currently outside of the scope of this guide, but includes consideration of topics such as corrosion, erosion, fatigue/vibration, brittle fracture, rotating equipment seal design, bolted joints, mechanisms of ageing/degradation etc. Design measures are numerous, and include approaches such as appropriate selection of materials (use of corrosion resistant alloys, low temperature resistant metals), minimisation of flanges through use of all-welded pipework, minimisation of the use of small bore tubing, minimising use of insulation (corrosion under insulation risk) etc. The mechanical engineering team (ED4.1) should be consulted for further support on these topics.

Industry Standards and Guidance

Inherently Safer Design  BS EN ISO 13702:2015 ‘Petroleum and Natural Gas Industries - Control and mitigation of fires and explosions on offshore production installations - Requirements and guidelines’  Energy Institute Publication ‘Guidance on applying inherent safety in design: Reducing process safety hazards whilst optimising CAPEX and OPEX’, Second Edition, 2014

Hazard Identification and Assessment Techniques  API RP 14C ‘Analysis, Design, Installation and Testing of Safety Systems for Offshore Production Facilities’, Eighth Edition, 2017  BS EN ISO 10418:2003 ‘Petroleum and Natural Gas Industries – Offshore Production Installations – Analysis, design, installation and testing of basic surface process safety systems’  BS EN ISO 17776:2016 ‘Petroleum and Natural Gas Industries – Offshore Production Installations – Major Accident Hazard management during design of new installations’  BS EN 60812:2006 ‘Analysis techniques for system reliability – Procedure for failure mode and effects analysis (FMEA)’  BS EN 61025:2007 ‘Fault Tree Analysis (FTA)’  BS EN 61882:2016 ‘Hazard and operability studies (HAZOP studies) - Application guide’  IChemE Publication ‘HAZOP: Guide to Best Practice’, Third Edition, 2015

Relevant HSE guidance

 HSE Publication L65, ‘Prevention of fire and explosion, and emergency response on offshore installations - Approved Code of Practice and Guidance’, Third Edition, 2016  HSE Publication L22, ‘Safe use of work equipment, Provision and Use of Work Equipment Regulations 1998 - Approved Code of Practice and Guidance’, Fourth Edition, 2014  HSE Publication L85, ‘A guide to the integrity, workplace environment and miscellaneous aspects of the Offshore Installations and Wells (Design and Construction, etc.) Regulations 1996 – Guidance on Regulations’, 1996

Inspection Approach

 Identify which hazard identification and assessment studies have been carried out. Assess if the range and scope is appropriate. Sample to confirm that all relevant process hazards have been identified, assessed, and suitable measures selected. Consideration should also be given as to whether the concept of Inherently Safer Design has been incorporated.  Check for a sample of the measures selected, that these have been implemented on the installation.  Check for a sample of the actions arising from the hazard identification studies that these have been completed, and review in more detail any that appear to be unresolved.  Request copies of key design paperwork (typically P&IDs, basis of design, datasheets, cause & effect charts) for a sample process plant system (e.g. gas compression) and check that these are internally consistent, clearly laid out, and meet expectations of good engineering practice for such documentation. Matters of Evident Concern

Inspection finding Examples Inadequate hazard assessment  No evidence of recent hazard and identification of suitable assessments, e.g. 5-yearly re-HAZOP measures of installation  Hazard assessments completed but number of actions outstanding Suitable measures not  Hazardous assessment actions have implemented been identified as completed but not implemented at site, e.g. plant change not carried out

B) PROCESS PLANT CONSTRUCTION (OFFSHORE) Fundamental Requirements

There should be a project safety plan, and all personnel, including third parties, should have been made aware of the overall aims of the project and how health and safety aspects are integrated into the plan.

Safety and Environmental Management System (SEMS) interfaces should have been clarified. If more than one SEMS applies, measures should be in place to ensure that there are no conflicts and that all relevant information has been effectively communicated to