Loc Process

LOSS OF CONTAINMENT - PROCESS
1.
Scope
This section provides guidance for the assessment of safety case content with respect to the loss of
containment from process plant and process operations, from hazard identification through to
elements of consequence determination, including risk management measures. However it
excludes assessment of the consequences of ignition of any release. This is considered separately
in Section 2.3.3.
2.
Assessment of Adequacy of Demonstration
The evaluation of risk that might stem from each major accident hazard is to be assessed by
identification of the factors that might result in an adverse combination of a source of hazard and
initiator, together with identification and evaluation of escalation paths that might result. Potential
sources of hazard, initiators etc, are shown in Section 4 below. Assessors should ensure that,
where relevant, safety cases contain appropriate consideration of each of these factors.
3.
Depth of Assessment
This section gives guidance on the depth of assessment required to determine the adequacy of the
demonstration that measures have been or will be taken to ensure compliance with the relevant
statutory provisions.
Where safety case contents match with good practice identified in the assessment sheets for a
particular element associated with a major accident, there will usually be no need for an assessor to
probe into the details of how the good practice is applied. This may, however, be a suitable issue
for follow-up by inspection.
4.
The assessor should examine the adequacy of the hazard identification, risk evaluation and
management in conjunction with the contents of the Categorisation Table below:

Loss of Containment - Process
Source of Hazard
Initiators
HS1 - Pressure
G1 - Corrosion:
Vessels (inc
Internal / External
Risk Evaluation
Frequency
Risk Management
Performance
Measures
Standards
F14 - Inherent
Vessels,
Safety
pipework,
tubing, tanks,
Columns)
- fully rated
vessels,
risers
pipework,
- Temperature &
pipelines, risers,
pressure rating
etc
- Material
-large segregation specification
distances
- Corrosion
- separate
allowance
accommodation
jacket
- inventory
minimisation
- Fatigue life
- Frequency of
inspection
- Relief
arrangements
and capacity
- Reliability of
protective
systems
- Adequacy of
supports
- Fire protection
HS2 - Heat
Exchangers
G2 - Erosion
F1 - Generic
F15 - Relief
historical data
systems
Heat
Exchangers
- Thermal rating
- Temperature
and pressure
rating
- Shell and tubeside flowrates
- Material
specification
- Fatigue life
- Frequency of
inspection
- Relief
arrangements
and capacity
HS3 -
G3 -
F2 - Company &
F16 - HIPS
Atmospheric
Overpressure
installation data
systems
Atmospheric
vessels
Vessels [eg
Wemcos, tilted
- Temperature &
plate separators,
pressure rating
deck tanks]
- Material
specification
- Corrosion
allowance
- Relief
arrangements
and capacity
HS4 -
G4 - Internal
F3 - Installation
F18 - Shutdown
Centrifuges/
Centrifuges /
explosion
specific hazard
systems
hydrocyclones
studies
- Temperature &
Hydrocyclones
- HAZOPs
pressure rating
- FMEAs
- Material
specification
- Design reviews
- Corrosion
allowance
- Separation
efficiency
- Vibration
(centrifuges)
HS5 Piping and G5 - Under
piping
components
pressurisation
F4 - Layout
F19 - Alarms /
Trips
Piping
- Temperature &
pressure rating
- Material
specification
- Corrosion
allowance
HS6 - Smallbore
G6 - Fatigue /
F5 - Company
tubing
vibration cracking standards /
F20 - Good
procedures
procedures
Tubing
- Temperature &
- operational
pressure rating
- maintenance
- Material
specification
HS7 - Pipeline
G7 - Fire
Risers (see
F6 - Corrosion /
F21 - Competent
erosion policy
personnel
F7 - Operational
F22 - Monitoring
reviews
& audit systems
section 2.3.2)
HS8 - Flexible
G8 - Seal failure
hoses
Flexible hoses
[procedures]
- Temperature &
pressure rating
- Material
specification
- Corrosion
allowance
- Fatigue life
- Frequency of
inspection
- Integrity of
connections
HS9 - Pumps
G9 - Turret
F8 - SIL
failure
standards
F23 - Isolations
compressors,
turbines
HS10 -
G10 - Inadequate F9 - Equipment
Compressors
installation
- Flowrate
selection [eg weld

- Head/pressure
or flange]
HS11 - Turbines
G11 - Operator
F10 - Concept
F24 - Gas
error: inadequate
selection
detection (see
section 2.3.3)
Training
- Shut-in pressure
- NPSH
- Turndown
Minimum flow
HS12 - Valves
G12 - Operator
Consequences:
F25 - Fire
error: inadequate
detection (see
competency
section 2.3.3)
Valves
- Sealing system
- Temperature &
pressure rating
- Material
specification
- Corrosion
allowance
- Closure mode
- Fire protection
- Integrty of seals
- Leakage rate
H13 Gas
treatment plant
G13 - Violation
F11 - Size of
Gas treatment
release
plant
- speed &
- Temperature &
effectiveness of
pressure rating
detection
response
- Material
specification
- blowdown
system
- Corrosion
allowance
- Performance
specification
HS14 - Marine
G14 - Deficient
storage tanks
procedures:
operational
F12 Dispension
Marine tanks
- open / closed
- Pressure rating
modules /
ventilation rates
- Fatigue life
- Frequency of
inspection
- Relief
arrangements
and capacity
- Reliability of
protective
systems
HS15 -
G15 - Deficient
F13 - Toxicity of
Hazardous
procedures:
release
drains / caissons
maintenance
HS16 - Integral
G16 - Ship
storage cells
collision
HS17 Flare and
G17 - Dropped
Flare and vent
vent towers
object
systems
- Temperature &
pressure rating
- Material
specification
- Corrosion
allowance
- Separation
efficiency
- Gas dispersion
- Thermal
radiation
- Noise level
- Turndown
HS18 - Turrets
G18 - Seismic
event
HS19 -
G19 - Missile [eg
Temporary
turbine blade]
Equipment
G20 - Ageing /
mechanical
degradation
G21 - External
loads [eg stood
on, struck by
scaffold pole]
G22 - Helicopter
collision / rollover
G23 - Inadequate
design
G24 - Incorrect
material
specification
G25 - Incorrect
material usage
G26 - Thermal
radiation
G27 - Slugging /
water hammer
G28 - Sloshing /
slam liquid loads
G29 - Structural
failure
HS1 Pressure Vessels (including Columns)

HS5 Piping and Piping Components
HS12 Valves
[Relevant Sheets: G17, G18, G20, G21, G29, G3, G5, G6, G8, G10, G27, F15, F18]
1. This sheet is generally applicable to the mechanical integrity of static components that form the
boundary of a hydrocarbon containment system; ie pressure vessels and piping etc. It is also of
relevance to rotating equipment, in so far as these also have pressure boundaries. Aspects specific
to machinery and rotating equipment are dealt with elsewhere. Similarly, process control and plant
isolation requirements are not dealt with here.
This sheet is not intended to limit the scope of an assessor to pursue any aspect of safety that they
believe is important to a particular safety case, within the remit provided by the safety case
regulations. It is though intended to provide guidance as to the minimum acceptable demonstration
of safety that a duty holder should be able to provide. As with all safety assessment work, there is a
need for HSE assessors to concentrate on areas where there are grounds for believing the safety
demonstration may be weakest. Knowledge of such areas comes from HSEs collective experience,
as well as that of the wider engineering community. This document is intended to provide pointers
towards what are believed to be the most pressing concerns. Conversely, it is not considered
necessary or practical for a particular safety case to mention explicitly all of the aspects of design
and operational concerns identified below. However the duty holder should in principle be able to
address all such concerns and hence provide an adequate demonstration of integrity. Therefore, it
is reasonable for an assessor to question a duty holder on any aspect of the integrity justification.
Confirmation should be obtained that the pressure system elements have been designed,
constructed, installed, and operated in accordance with a recognised standard or code of practice.
As a general principle, HSE accepts that codes, standards published by BSI, ASME, API and
others, are for the most part well founded, in that they have been written to encompass the present
best knowledge and advice available. However adherence to a code is not in itself a demonstration
of safety. There are several reasons for this. Not only are some codes inherently goal oriented
themselves, but there are also some matters which are the subject of technical uncertainty, or
indeed where current code provisions appear to be inadequate or may not reflect the state of the
art. The safety case assessment process may therefore include questioning as to the detailed
application or adequacy of parts of codes. A typical, but non-exhaustive, list of standards and codes
of practice would include:
PD5500: 2009+A3:2011 Specification for unfired fusion welded pressure vessels
ASME VIII Boiler and pressure vessel code
BPVC Section VIII-Rules for Construction of Pressure Vessels Division 1 (BPVC-VIII-1 2010)
BPVC Section VIII-Rules for Construction of Pressure Vessels Division 2-Alternative Rules
(BPVC-VIII-2 - 2010)
BPVC Section VIII-Rules for Construction of Pressure Vessels Division 3-Alternative Rules
for Construction of High Pressure Vessels (BPVC-VIII-3 - 2010)
BS EN 13445 Unfired pressure vessels
BS EN 13445-1:2009 Unfired pressure vessels. General
BS EN 13445-2:2009 Unfired pressure vessels. Materials
BS EN 13445-3:2009 Unfired pressure vessels. Design
BS EN 13445-4:2009 Unfired pressure vessels. Fabrication
BS EN 13445-5:2009+A3:2011 Unfired pressure vessels. Inspection and testing
BS EN 13445-6:2009 Unfired pressure vessels. Requirements for the design and fabrication
of pressure vessels and pressure parts constructed from spheroidal graphite cast iron
BS EN 13445-8:2009 Unfired pressure vessels. Additional requirements for pressure vessels
of aluminium and aluminium alloys
Part 7 isn't published as a "British Standard" but as a "Published Document"
PD CR 13445-7:2002 Unfired pressure vessels. Guidance on the use of the conformity
procedures
PD CEN TR 13445-9:2011 Unfired Pressure Vessels Conformance of the EN 13445 series
to ISO 16528
ASME B31.3 2010 Process piping
ISO13703 2000 [API 14E] Petroleum and natural gas industries. Design and installation of
piping systems on offshore production platforms. BS equivalent is BS EN ISO 13703:2000
ISO 15649 2001 Petroleum and natural gas industries. Piping. BS equivalent is BS ISO
15649:2001
PD CEN/TR 14549 2004 Guide to the use of ISO 15649 and ANSI/ASME B31.3 2010 for
piping in Europe in compliance with the Pressure Equipment Directive
ISO 14692 Parts 1 to 4 Petroleum and natural gas industries. Glass-reinforced plastics
(GRP) piping. Current versions are from 2002, BS equivalent;
BS EN ISO 14692-1:2002
BS EN ISO 14692-2:2002
BS EN ISO 14692-3:2002
BS EN ISO 14692-4:2002
BS 4994 1987 Specification for design and construction of vessels and tanks in reinforced
plastics. Replaced by BS EN 13923:2005 and BS EN 13121-3:2008+A1:2010
Codes to assist in-service integrity:
A typical but non-exhaustive list of relevant standards would include:
ASME Boiler and Pressure Vessel Code Series Please see BPVC-VIII-1 2010, BPVC-VIII2 - 2010and BPVC-VIII-3 - 2010
Inspection:
API 510 Pressure vessel inspection code: Maintenance inspection: In-service inspection,
rating, repair, and alteration current version is 9th edition 2006
API 570 Piping Inspection Code: In-service Inspection rating, repair and alteration of piping
systems current version is 3rd edition 2009
API RP 574 Inspection practices for piping system components current version is 3rd edition
2009
EEMUA Standards
API RP 580 Risk based inspection. Current version is 2nd edition 2009
API 581 Risk based inspection technology. Current version is 2nd edition 2008
Flaw assessment:
BS 7910 2005 Guide to methods for assessing the acceptability of flaws in metallic
structures Fitness for purpose:
Fitness for service
API 579-1 Fitness for Service current version is 2nd edition, 2007
DNV RP F101 Corroded pipelines. Current version 2010
The emerging ASME Post Construction codes are likely to provide useful benchmarks for
inspection planning, flaw evaluation, repair, and testing.
2. Where a standard or code of practice other than those listed above has been employed,
judgement as to the adequacy of alternative measures can only be assessed on an individual basis,
and the duty holder should be required to provide an engineering justification of how an equivalent
level of health and safety performance is delivered.
The avoidance of loss of containment relies primarily on the integrity of the containment in which
the hydrocarbons are held. The issue of mechanical integrity can itself be subdivided into issues of
initial integrity and continuing integrity.
2.1
Initial integrity
Adequate initial integrity is delivered by adherence to suitable design principles, often embodied in
codes and standards. Full consideration should be taken of design details, operating and fault
conditions, material properties and potential failure modes. Related issues include the provision of
protective systems. Delivery of the design intent is provided by suitable quality controls on
manufacture followed by appropriate inspection and testing.
Adequate initial integrity is ensured by adherence to the following engineering principles.
Risks implicit in the design should be identified. [APOSC 91]
Engineering design should seek to minimise risk and adopt a hierarchical approach [APOSC
92 & 98]
Appropriate industry standards should be used.
Engineering structures important to safety should maintain their integrity through life,
requiring a demonstration that normal operating loads and foreseeable extreme loads have
been quantified.
The materials used should be suitable. [APOSC 95]
Active safety features should have demonstrably adequate reliability, availability and
survivability
2.2
In-service Integrity
Following a consideration of the initial integrity, attention must be turned to the continuing integrity
of the containment, throughout its service life. This is ensured by; operating the plant within the
limits for which it was designed; by carrying out appropriate maintenance and through periodic
examination by a competent person, to identify significant inservice degradation. Also, procedures
must be in place to ensure that modifications to the plant will not compromise the integrity of the
containment. Finally, the duty holder needs to be sure that the assumptions made at the design
stage are still valid. For example, a change of usage may lead to faster corrosion/erosion rates and
different applied loads may invalidate the design fatigue assessment. The effects of ageing need to
be considered to ensure that the inspection regime addresses all of the deterioration modes taking
place.
3. Relevant Legislation, ACOP and Guidance includes:
Offshore Installations (Safety Case) Regulations 2005, Regulations 12(1)(c) & 12(1)(d) &
Schedules
Offshore Installations (Prevention of Fire and Explosion, and Emergency Response)
Regulations 1995, Regulations 9 and 19
Provision and Use of Work Equipment Regulations 1998, Regulations 4, 5 and 6
Lifting Operations and Lifting Equipment Regulations 1998, Regulations 8 and 9
Pressure Equipment Regulations 1999, Regulations 7 and 10

Assessment Principles for Offshore Safety Cases [APOSC] 14, 16, 35, 41, 91, 92, 95, & 98
4. Specific technical issues:
Relevant initiators and potential failure mechanisms are identified below:
4.1
Primary & Secondary Loads
Primary loads typically include design pressure and self-weight etc. Secondary loads typically
include thermal loads and equipment displacements etc. Adherence to the relevant design codes
and standards should ensure that the pressure systems are adequately designed for primary and
secondary loads.
4.1.1 Overpressure [Initiator G3]
Pressure system should be designed for maximum and, where relevant, the minimum anticipated
operating pressure under all modes of operation. It needs to be borne in mind that the maximum
operating pressure may not occur during the normal mode of operation. Designing equipment and
systems to the maximum pressure to which it can be subjected can have advantages in simplifying
plant by reducing or eliminating protection or relief systems. Based on established design
pressures, the facilities should be protected with recognised relief devices discharging to suitable
disposal or an instrumented high integrity protection system or a combination of both. The latter
subject is covered in F16. Possible sources of overpressure need to be identified and allowed for.
Issues for Safety Case Assessment
It should be established whether provision against over pressurisation is provided by active
measures, such as pressure relief and control systems, or is dependent upon the strength of the
component itself. Later in life, plant changes may necessitate reassessment.
When overpressurisation is a foreseeable event, the consequences should be considered. The
nature of the failure should be determinable, ie whether a leak or a catastrophic failure could result.
Further assessment of consequence could include assessment of the hazards posed by any
release.
4.1.2 Risers and Topsides Pressure Rating [Initiator F15]
It is normal practice in offshore industry to use different design codes for the design of topside
piping and risers. Risers are normally designed to pipeline design codes, such as BS 8010 and
topside piping is normally designed to piping code ASME B31.3 2010. Both the codes use different
factor of safety in the design of pressure systems for primary and secondary loads. Hence it is
important that at the specification break between riser and topside piping the pressure rating on
both sides, ie riser and topside, is compatible.

It should be established that specification break made between topside piping and a riser is made
at appropriate location so that the design requirements of respective design codes are satisfied.
4.1.3 Under-Pressurisation [Initiator G5]
Underpressure events also have the potential to cause failures i.e. by implosion if the underpressure that results is below atmospheric pressure [vacuum conditions]. Normally, integrity is
assured by adherence to a recognised design code.
4.1.4 External Loads and Structural Support Failure [Initiators G21 & G29]
Lack of consideration of pipe supports and movement of piping and connected equipment at the
design phase can result in failure of supports, leakage at flanged joints and overloading of sensitive
equipment such as pumps and compressors etc.
External loads could come from a disturbance of the structure itself, ie a partial failure or relative
displacements. External movements may result from vessel movements [FPSO] or wind sway, eg
piping supported from a tall slender tower or temperature changes in connected equipment. Loads
due to such movements need to be considered and adequate flexibility should be provided within
the pipework.
For floating vessels, the motion may well contribute significantly to the fatigue load
Confirmation that external loads acting on the pressure system have been considered and allowed
for in the mechanical design.
4.1.5 Inadequate Installation [Initiator G10]
Inadequate installation of plant is a significant source of engineering failure. Deficiencies include
misalignment of mating parts, incorrect welding and jointing procedures, inadequate inspection, and
the omission of certain parts of the overall commissioning process, such as pressure testing.
Commissioning procedures should be in place to ensure that installed pressure equipment is
inspected before use to identify any design faults that may have been introduced at the construction
stage and to confirm suitability for use.
Does the duty holder have an effective safety management system for installation and modification
of plant.
4.1.6 Seismic Event [Initiator G18]
If seismic events are deemed a possibility, then in principle the effects can be included as a design
load case. In such a situation, the response of the structure will have been calculated and the
resultant motion would have to be imposed on the hydrocarbon containment system.
Whether seismic assessment has been carried out at the design stage.
4.2
Occasional Loads
These include slugging, water hammer, wind, sloshing and liquid slam, etc [G27 & G28].
During design, the operation of each piping system needs to be clearly understood not only under
normal conditions but also those conditions arising during start up, shutdown and as a result of
process upsets.
The dynamic loads produced by the movement of fluids within a pressurised system can be
considerable. Excitation from valve slams or from flow instabilities has been known to be a source
of severe vibration.
The safety case should make it clear that occasional loads have been considered during the design
phase.
4.3
Degradation in Service
4.3.1 Corrosion
Please refer to generic sheets G1 Parts 1 & 2 & F6.
Piping containing hydrocarbons should avoid 'dead legs' and be designed to facilitate drainage to
prevent trapping of fluid.
4.3.2 Erosion
Please refer to generic sheets G2 & F6.
4.3.3 Fatigue/Vibration Cracking G6]
Fatigue is a damage mechanism by which cracks can propagate in a structure under the influence
of repeated cycles of stress well below the level capable of causing general yielding. Fatigue is
often characterised as occurring in two phases, the first is that of initiation, i.e. from manufacture up
to the point where a detectable crack is present. The second is the phase of defect growth, where
propagation from the point of detectability to the point of failure occurs.
Fatigue is addressed initially at the design stage. There are a number of methodologies by which
this can be done. However we note that for plant with a limited fatigue load, the codes normally
provide for the exclusion of a full analysis, providing that certain preconditions can be met, i.e. it is
established that there will only be a limited number of full pressure cycles etc.
In general though, the fatigue loads from all sources of repetitive stress have to be characterised
both in terms of the stress amplitude and their number. This can be used to determine a fatigue
lifetime for the component.
The importance of fatigue as a potential failure mechanism varies greatly according to the type of
duty a pressure vessel or piping system is subjected to. However, in an environment where
installations are increasingly being used beyond its original design lifetime, there are important
issues as to whether the plant is still within its original fatigue life. For older plant, the duty holder
could be questioned as to the current validity of the original fatigue calculations.
Experience has shown that fluid induced vibration is a significant cause of failure in offshore
pressure systems, affecting both vessels and piping. Such type of vibration is perhaps somewhat
difficult to treat within design codes. Further guidance on this topic is provided in:
Guidelines for the avoidance of vibration induced fatigue failure in process pipework published by
the Energy Institute
It is a reasonable question to ask how the duty holder assures the integrity of plant against this
source of fatigue.
4.3.4 Seal/Gasket/Compression Fitting Failure G8]
A suitable demonstration should be provided for the integrity of joints and seals where failure could
lead to a release of hydrocarbons. General information should be provided to indicate that flanges
and other joints have been adequately designed and properly made to avoid flammable and toxic
hazards. Further guidance is available in Guidelines for the management of the integrity of bolted
joints for pressurised systems published by the Energy Institute.
4.3.5 Fully Welded Topside Pipework in Critical Areas [F18 & F9]
The use of fully welded pipework topside is one of the approaches to adhere to the principle of
inherently safer design. However, for ease of access for operation, inspection, maintenance and
repairs, it is not possible to have fully welded pipework everywhere on topside plant. The duty
holder should avoid routing of pipework containing hazardous fluid through non hazardous area. If
this is unavoidable then pipework shall be all welded [no flanges] and not located in a vulnerable
position where it may be mechanically damaged.

It should be established in the safety case that as far as possible hydrocarbon pipework in nonhazardous areas is fully welded.
4.4
Materials
Materials chosen should be suitable for the application in terms of the process fluid, environment
and applied loading.
4.4.1 Incorrect Material Specification
Please refer to G24 regarding issues relating to incorrect material specification. Issues relating to
incorrect material usage [G25] are addressed by ensuring that pressurised equipment is designed
and manufactured in accordance with a recognised design standard as indicated in Section
1above.
4.4.2 Brittle Fracture
The prevention of brittle fracture is addressed within design codes. Prevention involves the correct
choice of materials, operation within strict temperature/pressure limits and monitoring ageing
phenomena such as embrittlement. Ferritic steels are subject to a ductile to brittle transition as
temperature decreases, rendering them highly vulnerable to brittle fracture when cold. Transition
temperatures vary, but are typically below ambient values for offshore applications. Ageing though
can lead to a shift in the transition temperature and render components more susceptible to brittle
fracture. Austenitic steels remain ductile at low temperatures and may be preferred for application
such as blowdown lines.
Brittle fracture is possible whenever low temperatures are involved, in particular low temperatures
associated with gas expansion. This is particularly the case when systems are still pressurised,
although in some circumstances, the differential stresses through the wall of a vessel by sudden
cooling could lead to crack propagation.
Choice of materials.
Identification of vulnerable components.
4.4.3 Ageing/Mechanical Degradation [G20]
The effect of ageing is undoubtedly one of the major integrity issues facing the older installations.
Ageing encompasses degradation mechanisms such as fatigue and corrosion. There are also some
other phenomena, for example creep and the deterioration in mechanical properties such as
fracture toughness. The latter phenomenon is associated with changes in transition temperatures.
Provision against these mechanisms is explicitly required, as part of the design criteria and
operational monitoring exists for the express purpose of detecting these phenomena.
Nevertheless, ageing related failures are occurring. The implication of this is that either plant is
being operated beyond its original design life, that conditions have changed because modification
has rendered the initial assumptions invalid or that inspection regimes are inadequate.
In recent years, the popularity of risk-based inspection schemes has led to situations where
inspection intervals have been lengthened for some plant. Where such decisions have been made,
the requirements on the knowledge about plant state are high.
As for fatigue, corrosion and other degradation phenomena above; including:
Whether initial design assumptions are still valid.
Whether modifications have had their implications on lifetime assessed.
Whether the inspection regime is adequate.
The adequacy of the duty holders piping repair policy to take account of HSE Safety Notice 4/2005
Weldless repair of safety critical piping and ISO TS 24817 Composite repairs for pipework
Qualification and design, installation, testing and inspection for composite repairs.
4.5
Dropped Loads G17]
Major hazards assessed are the impact of dropped loads onto hydrocarbon containment plant and
or accommodation areas. Protection essentially relies upon having an effective safety management
system.
Typical benchmarks employed include:
HSG221 Technical guidance on the safe use of lifting equipment offshore
BS 7121-2 & 11 Code of practice for the safe use of cranes
Step Change lifting and mechanical handling guidelines
OGP 376 Lifting and hoisting safety recommended practice
OPITO Training and competency assessment standards for crane operators, riggers, and
banksmen / slingers
OMHEC Practical guidance on communications for safe lifting and hoisting operations
HSE Safety Notice 2/2005 Single line components in the hoisting and braking systems of
offshore cranes

Plans showing crane over sail area and identification of areas where pipelines, HC piping and
vessels and accommodation units are vulnerable to dropped loads and or boom collapse.
References to dropped object/load impact studies and their conclusions. Provision of protective
barriers on vulnerable areas.
Description of cranes and lifting machinery including safe working load, de-rating for prevailing sea
state, and rated capacity indicator.
Details of the arrangements for maintenance and thorough examination of cranes including details
of structured engineering studies (e.g. FMECA) to give assurance that maintenance address ageing
issues
Details of how competence is assessed for crane operators, banskmen, slingers and for those
responsible for planning lifting operations.
Evidence that lifting operations are planned and assistance is available to identify and plan nonroutine lifts.
Personnel transfer using cranes and carriers
Some designs of carriers used for personnel transfer between an installation and vessel can
accommodate more than four persons. This introduces a new major accident hazard that must be
addressed in the safety case.
Typical benchmarks employed include:
HSE Offshore Information Sheet 1/2007 Guidance on procedures for the transfer of
personnel by carriers
Emerging guidance on lifting of persons from OMHEC
An assessment of how this major accident risk is addressed describing the control measures
in place to ensure the suitability of crane, suitability of the carrier, procedural controls
including recovery from the sea and competency.
5. Other Related Assessment Sheets in this Section are:
G1 Part 1
Corrosion: Internal
G1 Part 2
Corrosion: External
G2
Erosion
G18
Seismic Event
F16
High Integrity Protection Systems [HIPS]
6. Cross-Referenced Sections and Sheets are:

Section 2.3.2 Loss of Containment - Pipelines
HS2 Heat Exchangers

1. Confirmation should be obtained that heat exchangers have been designed, constructed in
accordance with recognised standards or codes of practice. Recognised standards/codes of
practice would include:
BS EN ISO 16812:2007 and API Standard 660 for shell & tube exchangers
BS EN ISO 15547-1:2005 and API Standard 662 for plate type heat exchangers
BS EN ISO 13706:2011 and API Std 661 for air cooled heat exchangers
BS EN ISO 13705:2006 and API Std 560 for fired heaters
TEMA Standards of the Tubular Exchanger Manufacturers Association are applicable for
tubular heat exchangers.
Pressure Vessel Design Codes applicable to heat exchangers:
PD 5500:2009 + A3: 2011 Specification for unfired fusion welded pressure vessels
Printed circuit heat exchangers [PCHEs] are normally designed to ASME VIII Division 1 but
other design codes such as PD 5500 can be employed as required by the purchaser.
API SPEC 12K Specification for Indirect Type Oil Field Heaters
2. Where a standard/code of practice other than those listed above has been employed,
judgement as to the adequacy of the heat exchange equipment can only be assessed on an
individual basis and the duty holder should be required to justify that the applied standard/code will
be equally effective.
Offshore Installations (Safety Case) Regulations 2005, Regulation 12(1)(c)
Assessment Principles for Offshore Safety Cases [APOSC] paras 14 and 35
Provision and Use of Work Equipment Regulations 1998 Regulation 4
4. Technical Issues:
4.1
Shell and Tube Heat Exchangers
Flow induced tube vibration which results in thinning of the tubes can occur where the tubes pass
through the tube sheets. The possibility of this occurring should have been examined as part of the
design.
The provision of overpressure relief for tube failure should be considered when the design pressure
for the low pressure side of the exchanger is low compared to the design pressure of the high
pressure side. A specific 2/3 rule is no longer contained in API 521. 5 th edition - section 5.19 (Heat
transfer equipment failure). The section now states Loss of containment of the low pressure side to
atmosphere is unlikely to result from a tube rupture where the pressure in the low pressure side
(including upstream and downstream systems) during the tube rupture does not exceed the
corrected hydrotest pressure.
[NB: Old 2/3 rule The provision of overpressure relief for tube failure should be considered when
the design pressure for the low pressure side of the heat exchanger is less than 2/3 of the design
pressure of the high pressure side. The 2/3 rule was written in the context of ASME pressure
vessel codes for which the test pressure was typically 150% of the design pressure . The 2/3 rule
was dependent on the hydrotest pressure being typically 150% of the design pressure, some
vessels are now hydrotested to 130% of the design pressure when the rule would become the
10/13 rule].
Related guidance:
API RP 521 Guide for Pressure Relieving and Depressuring Systems. 5 th ed, 2007 (includes
2008 addendum). ISO 23251.
Guidelines for the Design and Safe Operation of Shell and Tube Heat Exchangers to
Withstand the Impact of Tube Failure, September 2000, ISBN 9780852932865
4.2
Printed Circuit Heat Exchangers
For PHCEs there is an issue with thermal cycling which has been known to have caused failure of
the integrity of the heat exchange matrix. This phenomenon is most likely to occur when the unit is
subjected to frequent start-ups and shutdowns. Confirmation should be sought that this has been
taken into account as part of the design process.
4.3
Gasketed Plate Heat Exchangers
There is a likelihood of significant hydrocarbon release to the atmosphere on gasket failure. Shields
should normally be fitted to prevent fluids from contacting personnel in the event of gasket failure.
There is a working pressure limitation for gasketed plate heat exchanger of approx 25 barg.
4.4
Brittle failure due to the formation of titanium hydrides
A particular design of shell and tube cooler with the tubesheet manufactured from titanium sheet
explosively bonded to steel suffered catastrophic failure due to the formation of titanium hydrides
when the interface was exposed to wet gas. HSE Safety Alert SA 1/2005 Catastrophic failure of
shell and tube production cooler.
4.5
Design Requirements for Heat Exchangers
The following would be expected in heat exchanger design:

a. protection against high internal pressure, e.g. tube failure,
b. appropriate design, selection and location of PSVs and bursting discs,
c. detection system for hydrocarbon leaks into heating or cooling medium,
d. safe discharge/disposal of leaking material,
2.3.1.HS1
Pressure Vessels (Including Columns)

None
HS3 Atmospheric Vessels (eg Wemcos, Tilted Plate Separators, Deck Tanks)
1. Confirmation should be obtained that atmospheric vessels and their accessories have been
designed and constructed in accordance with recognised standards or codes of practice.
Recognised standards/codes of practice would include:
API Standard 2000 Venting Atmospheric and Low Pressure Storage Tanks; Non
Refrigerated and Refrigerated, 6th Edition, November 2009 (ISO 28300:2008 identical)
API Publication 2210 Flame Arresters for Vents of Tanks Storing Petroleum Products
BS EN ISO 16852:2010 Flame arrestors Performance requirements, test methods and
limits for use
API Bulletin 2521 Use of Pressure-Vacuum Vent Valves for Atmospheric Pressure Tanks to
Reduce Evaporation Loss
API Standard 620 Design and Construction of Large, Welded, Low Pressure Storage Tanks
API Standard 650 Welded Steel Tanks for Oil Storage
API SPEC 12D Specification for Field Welded Tanks for Storage Production Liquids
API SPEC 12F Specification for Shop Welded Tanks for Storage of Production Liquids
API SPEC 12B Specification for Bolted Tanks for Storage of Production Liquids
API SPEC 12P Specification for Fibreglass Reinforced Plastic Tanks
BS 1564:1975 Specification for pressed steel sectional rectangular tanks
BS EN 14015:2004 Specification for the design and manufacture of site built, vertical,
cylindrical, flat-bottomed, above ground, welded, steel tanks for the storage of liquids at
ambient temperature and above (replaces BS 2654:1989)
Withdrawn BS 2654:1989 Specification for the manufacture of vertical steel welded nonrefrigerated storage tanks with butt-welded shells for the petroleum industry
judgement as to the adequacy of the atmospheric vessel can only be assessed on an individual
basis and the duty holder should be required to justify that the applied standard/code will be equally
effective.
Assessment Principles for Offshore Safety Cases [APOSC] paras 14, 16 and 35
Provision and Use of Work Equipment Regulations 1998, Regulation 4
Offshore Information Sheet No 2/2010 - Reducing the risks of hazardous accumulations of
flammable/toxic gases in tanks and voids adjacent to cargo tanks on FPSO and FSU
installations
Loss of Containment Manual Part 9.4 - Inert Gas Controls/Cargo Tank Blanketing
5. Specific Technical Issues:
4.1
Venting for Fire Exposure and In/Out Breathing
It is likely that tanks installed on offshore installations will not be fitted with a frangible roof-to-shell
attachment for fire venting purposes. Where this is the case, confirmation should be sought that
venting capacity is adequate for fire exposure conditions.
API 2000 6 th edition now includes new, more accurate, equations for normal venting as opposed to
fire exposure where the equations stay the same. The new normal venting equations deal with
inbreathing and outbreathing caused by liquid movements and thermal effects. However the old
normal venting methods are still valid and appear as an Annex of API 2000.
4.2
Bunding
It should be clear that any decision as to whether tanks should be bunded or not has been made in
the light of a corresponding fire analysis.
4.3
The emergency dumping/draining of the flammable content of large tanks should have been
considered.
4.4
Consideration should have been given to minimising storage tank sizes and inventories as
part of a wider consideration of an inherently safer design features.

4.5
Methanol Storage Tanks
Provision should be made to limit the discharge of methanol vapour to atmosphere. For large
storage tanks, the provision of an inert gas blanket should have been considered.
4.6
Design Requirements for Atmospheric Vessels
The following would be expected in atmospheric vessel design:

a. appropriate venting arrangements, e.g. two independent adequately sized vents,
b. appropriate and adequate bunding.
2.3.1.F14
Inherent Safety

None
HS4 Centrifuges / Hydrocyclones

1. Confirmation should be obtained that centrifuges and hydrocyclones have been designed, and
constructed, in accordance with recognised standards or codes of practice. Recognised
standards/codes of practice would include:
PD 5500:2003 Specification for unfired fusion welded pressure vessels
judgement as to the adequacy of the centrifuge or hydrocyclone can only be assessed on an
individual basis and the duty holder should be required to justify that the applied standard/code will
be equally effective.
4. Technical Issues:
None
2.3.1.HS1
Pressure Vessels (Including Columns)

None
HS6 Smallbore Tubing

1. Confirmation should be obtained that the design, installation and maintenance of smallbore
tubing is in accordance with recognised standards or codes of practice. Recognised
Guidelines for the management, design, installation and maintenance of small bore tubing
assemblies: Energy Institute.
2. Where a standard/code of practice other than that listed above has been employed, judgement
as to the adequacy can only be made on an individual basis and the duty holder should be required
to justify why equivalent standards of safety should result.
Loss of Containment Manual Part 2 Small bore piping and tubing systems
None over and above those described in the referenced standard.

None
None
HS8 Flexible Hoses

1. Confirmation should be sought that the design, specification and usage of flexible hoses used on
the installation is in accordance with a recognised standard or code of practice. Recognised
standards/codes of practice include:
Guidelines for the management of flexible hose assemblies: Energy Institute, Oil and Gas UK, HSE,
2 nd edition, February 2011
as to the adequacy can only be made on an individual basis and the duty holder should be required
to justify why equivalent standards of safety should result.
Loss of Containment Manual Part 2 Small bore piping and tubing systems
None
6. Cross-referenced Sections and Sheets are:
None
HS9 Pumps
HS10 Compressors
HS11 Turbines
[Relevant Sheets:G7, G19]
1. Introduction
This sheet is to provide guidance for safety case assessment for areas dealt with by the Mechanical
Systems Team OSD3.4. What follows is therefore generally applicable to the mechanical integrity
of machinery and rotating equipment. Aspects specific to hydrocarbon containment are dealt with
elsewhere. Similarly, process control and plant isolation requirements are not dealt with here.
The document is not intended to limit the scope of an assessor to pursue any aspect of safety that
they believe is important to a particular safety case, within the remit provided by the Safety Case
Regulations. It is though intended to provide guidance as to the minimum acceptable demonstration
of safety that a duty holder should be able to provide. As with all safety case assessment work,
there is a need for HSE assessors to concentrate on areas where there are grounds for believing
the safety demonstration may be weakest. Knowledge of such areas comes from HSEs collective
experience, as well as that of the wider engineering community. There is some guidance below that
provides pointers towards what are believed to be the most pressing concerns. Conversely, it is not
considered necessary or practical for a particular safety case to mention explicitly all of the aspects
of design and operational concerns identified below. However, the duty holder should in principle be
able to address all such concerns and hence provide an adequate demonstration of integrity.
Therefore, in the last resort, it is reasonable for an assessor to question a duty holder on any
aspect of the integrity justification.
2. Machinery and Rotating Equipment Integrity
Machinery and rotating equipment is often packaged together to form a single system. The
packages employ a combination of rotating equipment such as pumps, compressors and
generators, driven by a gas turbine or electric motor. Typical applications include:
Process and export gas compression
Oil export pumping
Fire water pumping
Utilities [electricity generation/compressed air]
Our main source of reference is HSEs Inspection Guidance Notes [IGN]: HSE Research report
076 Machinery and Rotating Equipment Integrity Inspection Guidance Notes.
The IGN provides technical guidance that focuses on commonly used equipment such as gas
compression and oil export packages, typical machinery including turbines, motors and diesel
engines, and rotating equipment such as pumps and compressors etc. The IGN provides an
understanding of the technology used and considers those aspects of design, operation and
maintenance that could contribute to a major offshore incident. The report also includes a
structured review to assist Inspectors gauge compliance with statutory requirements and it gives
examples of poor practice to look out for.
A comprehensive list of relevant standards is provided in Section 5.15 of the IGN.
Our main references for gas turbine safety include:
ISO 21789 Gas turbine applications - Safety
Offshore gas turbines (and major driven equipment) integrity and inspection guidance notes
HSE Research Report 430
Fire and explosion hazards in offshore gas turbines HSE Offshore Information Sheet
10/2008
3. Relevant Legislation, ACOP and Guidance Includes:
None
None
HS13 Gas Treatment Plant

1. Confirmation should be obtained that gas (and oil) treatment processes and plant have been
designed and constructed in accordance with recognised standards or codes of practice.
Recognised standards/codes of practice for design of vessels, piping, valves, etc are given in other
sections of this chapter. However specific standards for treatment processes includes:
API RP 55 Conducting oil and gas producing and gas processing plant operations involving
hydrogen sulphide.
EFC Pub 16 Guidelines on materials for carbon and low alloy steels for H 2S containing
environments in oil and gas production
EFC Pub 17 Corrosion resistant alloys for oil and gas production Guidance on general
requirements and test methods for H 2S service
EFC Pub 23 CO 2 corrosion control in oil and gas production
NACE MR0175 Sulphide stress cracking resistant materials for Oilfield Equipment
as to the adequacy of the system can only be assessed on an individual basis and the duty holder
should be required to justify that the applied standard/code will be equally effective.
Offshore Installations (Safety Case) Regulations 2005, Regulations 12(1)(c)
Assessment Principles for Offshore Safety Cases [APOSC] Principle 4
Provision and use of Work Equipment Regulations 1998, Regulation 4
4.1 Materials of construction, appropriate to the service conditions and composition of the
fluids, should be specified and used.
4.2 The consequences of a release of toxic material should be addressed and appropriate
control and mitigation measures should be outlined.
4.2 Adsorbent and absorbent materials may be used to treat the gas stream. These
substances (e.g. amine) may themselves give rise to hazards. The consequences of
breakthrough of substances (e.g. elevated levels of H 2S) on the downstream plant should be
addressed.
2.3.1.HS1
Pressure vessels
2.3.1.HS2
Heat exchangers
2.3.1.HS5
Piping
2.3.1.HS6
Small bore tubing
HS8
Flexible hoses
HS9
Pumps
HS10 Compressors
HS17 Flare and vent towers
G1
Corrosion
G20
Ageing / material degradation
G24/25
Incorrect material specification and usage
F11
Size of release, speed of detection and effectiveness
F12
Dispersion

None.
HS15 Hazardous Drains / Caisson

1. Confirmation should be obtained that the hazardous drains system and disposal caisson have
been designed and constructed in accordance with recognised standards or codes of practice.
Recognised standards/codes of practice include:
Pipework:
ANSI B31.3 Petroleum refinery piping
Sump Tanks & Disposal Caisson:
API Standard 2000 Venting Atmospheric and Low Pressure Storage Tanks; Non Refrigerated
and Refrigerated, 6th Edition, November 2009 (ISO 28300:2008 identical)
API Publication 2210 Flame Arrestors for vents of tanks Storing Petroleum products
as to the adequacy of the hazardous drains system and disposal caisson can only be assessed on
an individual basis and the duty holder should be required to justify that the applied standard/code
will be equally effective.

Loss of Containment Manual Part 8.6 Segregation of hazardous drains
4.1
Flame Arrester
The hazardous drains sump tanks and disposal caisson will generally be vented to the atmospheric
vent header although, in some cases, a dedicated vent may be provided. In either case, the vent
should be fitted with a flame arrester designed to API 2210, ISO 16852 or equivalent.
4.2
Wave Action
The drains sump vent should be of sufficient capacity to accommodate the inbreathing and
outbreathing due to the rise and fall in liquid level as a result of wave action.
Dip pipes, within the caisson, should terminate at sufficient depth to ensure that they are
submerged at all times.
4.3
Dip Pipe Perforation
Dip pipes can be subjected to accelerated rates of corrosion at, or just below, the liquid level in the
caisson. Perforation resulting from such corrosion may result in the migration of hydrocarbon
vapour from the caisson into the drains system, [this has resulted in a number of hydrocarbon
releases]. Confirmation should be obtained that there is an inspection scheme in place to address
this phenomenon.
4.4
Inappropriate inter-connections
A number of hydrocarbon releases have resulted from poor design involving inappropriate
interconnections between the closed/flare system and the open drains. Plant blowdown then
causes gas to discharge from the open drains. Confirmation should be sought that this possibility
has been examined during the plant HAZOP studies.
4.5
Design Requirements for Open and Closed Drains
The following would be expected in open and closed drains design:

a. segregation of open and closed drains,
b. open drain systems are typically classified as hazardous and non-hazardous. It is important
that segregation of the drain systems is maintained at times and under all foreseeable
conditions to prevent migration of hydrocarbons into safe areas where they may present an
ignition risk,
c. maintaining appropriate slopes to achieve drainage,

d. dedicated closed drain vessel or appropriate integrity and segregation if flare vessel is used
as a drain drum,
e. isolation of drain points to prevent over-pressurisation of drain system from HP process
plants, e.g. spades or locked valves.
None
None
HS17 Flare and Vent Towers

1. Confirmation should be obtained that flare towers have been designed and constructed in
accordance with recognised standards or code of practice. Recognised standards/codes of practice
include:
API Standard 521 American Petroleum Institute [5th edition January 2007] Pressure
Relieving and Depressurising Systems (ISO 23251 identical)
BS EN ISO 25457:2008: Flare details for general refinery and petrochemical service
The Institute of Petroleum [2001] Guidelines for the Safe and Optimum Design of
Hydrocarbon Pressure Relief and Blowdown Systems ISBN 0 85293 287 1
The above codes, standards and guidance are applicable to flare towers on both fixed installations
and FPSOs. Well test equipment on drilling installations is likely to have dedicated well test flare
booms.
as to the adequacy of the flare tower can only be assessed on an individual basis, and the duty
holder should be required to justify why its procedures/practices in the relevant areas will deliver an
equivalent level of health and safety performance.
Loss of Containment Manual Part 5.5 Relief/blowdown/flare system integrity

A review of lessons learned from past incidents is given in Section 6 of Institute of Petroleum
Guidelines for the Safe and Optimum Design of Hydrocarbon Pressure Relief and Blowdown
Systems. This guide includes checklists for assessment of relief and blowdown systems [pp 100102] for both designers and operators. The guide should be included as part of the assessment
process.
An overview of radiation exposure levels is given in Section 5.8 of theInstituteofPetroleum
Guidelinesfor the Safe and Optimum Design of Hydrocarbon Pressure Relief and Blowdown
Systems. Confirmation should be obtained that the suggested limits are not exceeded.
The Design Requirements for Relief, Vent and Flare Systems are covered as a specific technical
issue in section 2.3.1 F15 Relief Systems.
2.3.1.F15
Relief Systems

None.
HS18 Mechanical Integrity of FPSO Mooring Turrets

[Relevant Sheets: G.9]
Introduction
1. Many floating production storage and offtake facilities [FPSOs] employ the principal of free
weathervaning of the hull round a geostationary mooring spread. For this purpose, the hull structure
is designed or modified to accommodate an internal turret to which static mooring lines are fixed
permitting unrestricted rotation of the vessel about that axis of fixation. The turret incorporates a
bearing arrangement similar to a crane slew ring to reduce friction and, also usually a high pressure
swivel system to permit and control the transfer of fluids from the stationary risers to the rotating
vessel and its processing and storage facilities.
The design and operational safety/integrity of the bearing and swivel arrangements are matters for
technical assessment by OSD Mechanical Specialists at the design safety case and operational
safety case stages. Other aspects such as integration of the turret with the hull structure and the
design/integrity of flowlines and flexible risers need to be addressed by respective specialist
sections.
2. Assessment Principles:
i. There are no national or international standards or formal codes for the design of turrets or
swivels, although they draw heavily upon existing large low speed bearing design and fluid/gas
sealing technology. Each example to date is a bespoke engineering solution and the most
appropriate method of assessment therefore involves the basic principals of hazard identification,
FMEA, Risk Assessment and whether risks are controlled to ensure compliance with the relevant
ii. OSD3.4, to obtain the information necessary to approach the assessment task in a competent
and consistent manner, commissioned a technical survey of published information covering all
FPSO and FSO installations in theUKsector. From this information a practical and comprehensive
database was created called:
The FPSO Turret and Swivel Interactive Knowledge Base
The IKB provides the following principal reference facilities:
i.
General description of turret systems

Ship structures
General systems and arrangements
Mooring systems and turret loadings
Scaffolding and support systems
Personnel
Construction standards
ii.
Turret system design

Major components and boundaries
Turret transfer systems
Interfacing systems
iii.
Fluid transfer systems
iv.
Failure modes
v.
Inspection and maintenance
vi.
Examples of good and bad practice
This extensive register encompasses detail of all existing turret mooring designs and arrangements
existing inUKwaters. In addition it discusses in appropriate technical language the merits and
weaknesses of respective systems and guides the reader first toward an appreciation of the
broader aspects of the technology, hazard identification and risk recognition processes, to a
position where specific examples may be subject to comparative appraisal against a cross industry
selection of design types and their operational characteristics and histories.
Offshore Installations (Safety Case) Regulations 2005, Regulation 12
Offshore Installations (Prevention of Fire and Explosion, and Emergency Response) Regulations
1995, Regulations 4, 5, 9 & 19
Offshore Installations and Wells (Design and Construction, etc) Regulations 1996, Regulations 4, 5,
6, 7 & 8
Failure modes, reliability and integrity of floating storage unit (FPSO,FSU) turret and swivel
systems HSE research report OTO 2001/073
4. For marginal field development the turret moored FPSO offers commercial attractions. Mooring
turrets clearly embody major hazard potentials including both the control of the transient hazardous
inventories within them and station keeping of the parent vessel. Full and intelligent use of the
FPSO turret database and application of its reflective appraisal procedures are the best means
available for assessing and evaluating both the design and the lifetime operational integrity of this
advanced production technology.
For the purpose of this manual mooring turrets have been assigned to Section 2.3.1 - Loss of
Containment - Process. However, the turret is a multi functional design feature, its construction and
housing form an integral part of the vessel primary structure and the mooring system. Whilst these
considerations are the responsibility of structural and marine specialists, structural strength and
especially stiffness are of paramount importance to the performance of the turret bearings, seals
and flanged joints. Consequently there are at least three safety critical elements to be assessed in
relation to the turret, namely integrity of primary and support structure, mooring integrity and the
integrity of fluid paths [flexible risers, swivels and rigid pipework]. It is therefore desirable that the
assessment of turret design and operational issues should be undertaken on a multi discipline basis
with input from OSD5 and other OSD3 Specialist Teams.
None
HS19 Temporary Equipment

1. Confirmation should be obtained that systems and procedures are in place to manage the risks
associated with the use of temporary equipment. These should be broadly in line with the guidance
given in SPC/TECH/OSD/25.
Confirmation should also be obtained that all temporary equipment has been designed and
constructed in accordance with recognised standards or codes of practice, or if not, justification
sought as to why the standard(s) employed should result in equivalent levels of safety.
2. Where systems and procedures differ markedly from those recommended in
SPC/TECH/OSD/25, judgement as to the adequacy of the management of risks associated with the
temporary equipment can only be assessed on an individual basis and the duty holder should be
required to justify that the applied systems and procedures will be equally effective.
Assessment Principles for Offshore Safety Cases [APOSC], paras 14 and 35

4.1
Deciding what is, and is not, temporary equipment
Essentially Temporary Equipment compromises equipment which is not a permanent part of the
installation, and which is intended to be removed after a finite period of time.
4.2
Impact of temporary equipment on existing plant/systems
A HAZID and HAZOP should have been conducted to ensure that the Temporary Equipment will
not compromise the integrity of the existing plant and systems [and vice versa].
4.3
Control of Change
There should be systems/procedures in place to control short term amendments to existing

procedures/documentation. The systems/procedures should cover the re-instatement of amended
material.
4.4
Competence and Training
Temporary training requirements need to be identified, recorded and implemented. Contractor

competence and training should be verified by the duty holder.
4.5
Control of Contractors
The integration of systems/procedures will be required where the Contractors have their own
systems/procedures for the operation, control and maintenance of the temporary equipment.
None
None
G1 Part 1 Corrosion: Internal

Topsides Plant
1. Confirmation should be obtained that internal corrosion is being managed through
implementation of a corrosion management system. There are no recognised standards or codes of
practice that deal with the corrosion management system. Hence in co-operation with the offshore
industry CAPCIS have prepared the research report OTO 2001/044 Review of Corrosion
Management for Offshore Oil and Gas Processing for HSE, which provides guidance and examples
of best practice. This is considered to be the benchmark that duty holders corrosion management
system should satisfy. Recognised standards and codes of practice dealing with certain specific
elements of corrosion management include:
DnV RP G-101 Risk Based Inspection of Topsides Static Mechanical Equipment
API Publication 581 Risk Based Inspection
HSE RR363/2001 Best Practice for risk based inspection as part of integrity management
RIMAP Generic Risk Based Inspection and Maintenance Planning
NORSOK standard M-506 CO2 Corrosion Rate Calculation Model
NORSOK Standard M-CR-505 Corrosion Monitoring Design
NACE Standard RP0775 Preparation and Installation of Corrosion Coupons and
Interpretation of Test Data in Oil Field Operations
NACE Standard RP0497 Field Corrosion Evaluation Using Metallic Test Specimens
NACE Standard RP0192 Monitoring Corrosion In Oil & Gas Production with Iron Counts
ASTM G4 Standard Guide for Conducting Corrosion Coupon Tests in Field Application
ASTM G96 Standard Guide for On-line Monitoring of Corrosion in Plant Equipment
[Electrical and Electrochemical Methods]
InstituteofPetroleumModel Code of Safe Practice for Petroleum Industry Part 13: Pressure
Piping Systems Examination
InstituteofPetroleumModel Code of Safe Practice for Petroleum Industry Part 12: Pressure
Vessel Systems Examination
EEMUA 193 Recommendations for the Training, Development and Competency
Assessment of Inspection Personnel
EEMUA 179 A Working Guide for Carbon Steel Equipment in Wet H2S Service [Developed
largely from Oil Refinery experience]
API RP574 Inspection Practices for Piping System Codes
API RP570 Piping Inspection Code: Inspection, repair, alteration and re-rating of in-service
piping systems
API RP510 Pressure vessel inspection code: Maintenance inspection, rating, repair, and
alteration
judgement as to the adequacy of corrosion management can only be assessed on an individual
basis, and the duty holder should be required to justify why its procedures/practices in the relevant
areas will deliver an equivalent level of health and safety performance.
Offshore Installations (Safety Case) Regulations 2005, Regulations12(1)(c) and 12(1)(d)
Assessment Principles for Offshore Safety Cases [APOSC], paras 95, 98 and 102
Regulations 1995, Regulations 4(1)(a); 9(b) and 12
Pressure Equipment Regulations 1999
The safety case assessment should seek to establish to what extent aspects of the corrosion
management system listed below have been addressed particularly because experience has shown
them to be contributory factors in corrosion incidents:
Clear, explicit policy governing corrosion and plant monitoring.
Sufficient inhouse expertise, clear allocation of responsibilities and involvement of offshore
staff to enable delivery of the policy.
Better analysis and integration of inspection and monitoring data including use of statistical
techniques to allow for uncertainties resulting from limitations of inspection techniques and
coverage.
Better use of opportunistic inspection.
Better documentation of system.
Increased utilisation of platform staff knowledge and raised awareness.
Widen scope of inspection plans that includes certain amount of speculative inspection.
Improved identification of corrosion hot spots based on plant walkabout rather then
examination of drawings.
Increased system performance monitoring and improved failure investigations that identify
underlying system failures.
Regular system reviews that includes assessment of system performance against set
criteria, evaluation of system failures and identification of areas to be improved.
Regular independent audits of the corrosion management system.
Ensuring high availability of inhibitor injection system.
Consideration of enhanced degradation near injection points due to local flow/environmental
conditions.
Planning of non-invasive inspection [NII] scheme based on considerations outlined in JIP
reports HOIS NII Decision Guidance, Mitsui Babcock GSP 235, Recommended Practice
for NII.
Minimisation of deadlegs and where unavoidable implementation of targeted inspection
scheme.
Identification of areas prone to pitting and application of the most appropriate inspection
techniques and prevention schemes including designing them out.
Identification of components that could suffer preferential weld corrosion and application of
appropriate specialised inspection techniques and prevention strategies. Further guidance in
JIP report Risk of preferential weldment corrosion of ferritic steels in CO2 containing
environments and the Guidelines for the prevention, control and monitoring of preferential
weld corrosion of ferritic steels in wet hydrocarbon production systems containing CO2.
Level of attention given to the hydrocarbon drains systems integrity management.
Special consideration of the failure mechanisms of smallbore piping [3 and below] and
application of appropriate inspection techniques.
Consideration of chloride stress corrosion cracking and or pitting in corrosion resistant

materials operating in environmental condition where high concentration of salts can
develop.
Management of process conditions [ie ensuring no oxygen] to prevent formation and
deposition of elemental sulphur in plant handling sour fluids.
More user friendly and accessible corrosion monitoring probe and chemical injection quill
access fittings and locations.
Inspection and monitoring data analysis including use of statistical and reliability methods.
How is past experience captured and incorporated in the design of corrosion protection
measures for new installations.
G2
Erosion
G6
Fatigue/Vibration Cracking
G15
Deficient Procedures: Maintenance
G20
Ageing/Mechanical Degradation
G24
Incorrect Material Specification
G25
Incorrect Material Usage

None
G1 Part 2 Corrosion: External

Topsides Plant and Structure
1. Confirmation should be obtained that external corrosion has been managed by implementation
of a corrosion management system. There is no single national or international standard dealing
with this topic and hence a number of approaches, including treating it as part of the process plant
corrosion management system or the installation fabric maintenance system have been adopted.
Recognised standards/codes of practice dealing with certain specific elements of corrosion
management include:
OT0 2001-011Corrosion Protection
BS5493 Code of practice for protection of iron and steel structures against corrosion
NORSOK standard M-501 Surface preparation and protective coatings

ISO 12944 Paints and Varnishes Corrosion Protection of Steel Structures
85 5493: 1977 Protective coating of iron and steel structures against corrosion.
EN ISO 14713: Protection against corrosion of iron and steel in structures - Metal coatings Guide.
EN ISO 1461: Hot dip galvanized coatings on fabricated products.
EN 10240: (Draft) Coatings for steel tubes: Specification for hot dip galvanized coatings.
ISO 4628-3: 1982 Paints and varnishes - Evaluation of degradation of paint coatings Designation of intensity, quantity and size of common types of defect - Part 3: Designation of
degree of rusting.
BS 7079: Part Al Preparation of steel substrates before application of paints and related
products - Visual assessment of surface cleanliness - Part 1: Rust grades and preparation
grades of uncoated steel substrates and of steel substrates after overall removal of previous
coatings.
ISO 9223: 1992 Corrosion of metals and alloys - Corrosivity of atmospheres - Classification.
ISO 11303:2002 Corrosion of metals and alloys - Guidelines for selection of protection
methods against atmospheric corrosion
EN 22063: 1993 Metallic and Other Inorganic Coatings - Thermal Spraying - Zinc, Aluminium
and Their Alloys
EEMUA 200 Guide to the specification, installation, maintenance of spring supports of piping
ISO CD 19902 Petroleum and natural gas industries Fixed offshore structures
judgement as to the adequacy of corrosion management system can only be assessed on an
individual basis, and the duty holder should be required to justify why its procedures/practices in the
relevant areas will deliver an equivalent level of health and safety performance.
Offshore Installations (Safety Case) Regulations 2005, Regulations 12(1)(c) and 12(1)(d
Assessment Principles for Offshore Safety Cases [APOSC] paras 95, 98 and 102
1995, Regulations 4(1)(a), 9(b) & 12
External corrosion of topsides on an ageing installation does not usually receive the same degree
of attention as the management of the internal corrosion with the result that on a number of
installations the primary threat of hydrocarbon release is from external corrosion. In addition a
significant number of personnel injuries on such installations are due to falls and trips resulting from
failure of corroded members used as temporary supports or steps. Corroded walkways have also
featured in a number of incidents. Particular issues that should be probed as part of the safety case
assessment include:
Management of process plant integrity around corrosion traps such as pipe supports,
penetrations, saddles, etc.
Management of the risks associated with surface preparation and painting on live plant.
Management of corrosion under insulation.
Management of bolt corrosion.
Management of pitting and stress corrosion cracking in corrosion resistant alloy piping and
tubing operating in areas exposed to sea spray/deluge. See RR129 Review of external
Stress Corrosion Cracking of 22% Cr Duplex Stainless Steel for further guidance.
Painting and refurbishment planning systems and performance standards including short
term remedies.
Maintenance of spring supports.
Corrosion management of walkways, hand railings, escape equipment attachment points
and other similar secondary structural components.
G15
G20
G24
Incorrect Material Specification
G25

None
G2 Erosion
1. Confirmation should be obtained that erosion is being managed through implementation of an

erosion management system that includes amongst other things selection of appropriate materials
and coatings, control of fluid velocities, removal/prevention of solid particles, effective detection
systems, plant design that minimises changes in flow direction and erosion resistant valve design.
Recognised standards/codes of practice dealing with erosion include:
DNV Recommended Practice RP 0501 Erosive Wear in Piping Systems
ISO 13703 Offshore Piping Systems
API RP14E Design and Installation of Offshore Production Platform Piping Systems
judgement as to the adequacy of erosion management system can only be assessed on an
individual basis, and the duty holder should be required to demonstrate its procedures/practices in
the relevant areas will deliver an equivalent level of health and safety performance.
Offshore Installations (Safety Case) Regulations 2005, Regulations 12(1)(c) and 12(1)(d)
1995, Regulations 4(1)(a), 9(b) and 12
There have been a number of major hydrocarbon releases recently caused by solids particle
erosion where failure of a number of crucial control measures had occurred. Wall thinning is usually
very rapid and hence prevention rather then control should be the guiding principle. Operations staff
do not always appreciate the impact of the production rate on erosion risk. Prevention of erosion in
the production plant can be achieved by design whereas for well servicing and drilling operations
process management is usually the only available option. Erosion tends to be a localised effect
which means that a very good knowledge of the local rather then global flow velocities is required in
order to assess erosion risks. Sand detection systems have proved to have varying reliability and
hence their effectiveness should be explored as part of the assessment process.
Relevant guidance documents include:
RR115 Erosion in Elbows in Hydrocarbon Production systems: Review Document
SPC/TECH/OSD/19 Offshore Produced Sand Management

G1 Part 1
Corrosion: Internal
G1 Part 2
Corrosion: External

None
G4 Internal explosion
1. Confirmation should be obtained that internal explosions have been assessed in accordance
with a recognised standard or code of practice. Recognised standards/codes of practice would
include:
HS025 Fire and Explosion Guidance, Oil and Gas UK/HSE 2007
Spouge, J, A Guide to Quantitative Risk Assessment for Offshore Installations, CMPT
(Centre for Marine and Petroleum Technology), 1999, Appendix IV Hydrocarbon event
consequence modelling (old)
BS EN ISO 13702:1999 Petroleum and Natural Gas Industries Control and Mitigation of
Fires and Explosions on Offshore Production Requirements and Guidelines.
The following document provides useful information but is based on a different regulatory regime,
so should be used with care to ensure consistency withUKlegislation:
VROM, Guidelines for quantitative risk assessment, Purple Book section 5, 2005
judgement as to the adequacy of the evaluation of the internal explosion hazard can only be
assessed on an individual basis, and the duty holder should be required to justify why its
procedures/ practices in the relevant areas will deliver an equivalent level of health and safety
performance.
3.
Relevant Legislation, ACOP and Guidance include:

Offshore Installations (Safety Case) Regulations 2005
Regulations 1995
Fire, Explosion and Risk Assessment Topic Guidance
http://www.hse.gov.uk/foi/internalops/hid/manuals/pmtech12.pdf
Fire and Explosion Strategy Document http://www.hse.gov.uk/offshore/strategy/index.htm

OTN 95 196 1995 Gas explosion handbook HSE-OSD report
Loss Of Containment Manual Part 8.5 Air ingress and flammable mixtures
http://www.hse.gov.uk/offshore/loss-of-containment-manual%202012.pdf
4.1
Internal explosions are regarded as a lower risk factor in comparison to topsides external
explosions. Specific attention should be paid to situations whereby air could ingress into a
hydrocarbon-saturated atmosphere and form a flammable air/vapour mixture. The risk from a gas
turbine sourced internal explosion should be assessed with particular emphasis on fuel/air control,
emergency shutdown control and internal conditions that could give rise to volumes of un-ignited
fuel air mixtures.
The adequacy of Internal Explosion venting available in each engine installation should also be
investigated.
4.2
Protection against air ingress and flammable mixtures in process
Flammable mixtures can form in piping, plant and equipment when air enters systems that normally
contain hydrocarbon, as a result of operational or maintenance activities. Correct purging and
operational procedures will ensure that the risks are minimised.
5. Other related assessment sheets in this Section are:
None
6. Cross-referenced Sections and sheets are:
Sheet
HS9
Sheet
HS10 Compressors
Sheet
HS11 Turbines
Sheet
F3
Installation Specific Hazard Studies
Sheet
F8
Safety Integrity Levels Standards
Sheet
F23
Fire/Smoke/Gas/Flame Detectors/Alarms
G7 Fire
Pumps
1. Confirmation should be obtained that requirements for the identification of fire hazards as
initiators to other hazardous events have been analysed in accordance with recognised standards
or codes of practice that would be used for a manned installation. Recognised standards/codes of
BS EN ISO 13702:1999 Petroleum and Natural Gas Industries Control and mitigation of
fires and explosions on offshore production installations requirements and guidelines.
The following document provides useful information but is based on a different regulatory
regime, so should be used with care to ensure consistency withUKlegislation:
judgement as to the adequacy of the evaluation of these hazards can only be assessed on an
individual basis, and the duty holder should be required to justify which its procedures/practices in
the relevant areas will deliver an equivalent level of health and safety performance.
Regulations 1995
Fire & Explosion Strategy Document
Offshore Information Sheet 10/2008 Fire and explosion hazards in offshore gas turbines
Offshore Information Sheet 11/2008 Contaminated lagging and self-heating
Specific attention should be paid to the identification of mitigation barriers to stop escalation paths
early in a hazardous event situation. For example, a fire detection system should be regularly
tested to maintain its design performance of identifying rapidly fires in accommodation as well as
process areas.
None
Sheet 2.3.3.F8
Fire Types
Sheet 2.3.3..F10
Fire Modelling
Sheet 2.3.3..F11
Explosion Modelling
Sheet 2.3.3..F28
Ventilation and HVAC
G24 Incorrect Material Specification

1. Confirmation should be obtained that material selection has been based on a rigorous
evaluation of all internal and external environments, operational and non operational conditions
including upset conditions, design life and system performance standards, failure modes and
consequences, inspection and monitoring requirements and health conditions. In addition to the
standards listed below most process plant component standards also cover material performance
requirements to some extent. Recognised standards/codes of practice dealing with materials
selection include:
NORSOK Standard M-001 Materials Selection
EEMUA 194 Guidelines For Materials Selection and Corrosion Control for Subsea Oil and
Gas Production Equipment
ASME B31.3 2010 Process Piping
ASME Boiler and Pressure Vessel Code Section VIII
BS5500 [PD 5500] Specification for Unfired Fusion Welded Pressure Vessels
EFC Pub 16 Guidelines on Materials For Carbon and Low Alloys Steels for H2S Containing
Environments in Oil and Gas Production
EFC Pub 17 Corrosion Resistant Alloys for Oil and Gas Production. Guidance on General
Requirements and Test Methods for H2S Service
EFC Pub 23 CO2 Corrosion Control in Oil and Gas Production
NACE MR0175 Sulphide Stress Cracking Resistant Materials for Oilfield Equipment
NORSOK Standards M-506 CO2 Corrosion Rate Calculation Model
ISO 14692 Petroleum and natural gas industries. Glass-reinforced plastics [GRP] piping
judgement as to the adequacy of materials specification can only be assessed on an individual
basis, and the duty holder should be required to justify which its procedures/practices in the
Offshore Installations (Safety Case) Regulations 2005, Regulations 12(1)(c), 12(1)(d)

Assessment Principles for Offshore Safety Cases [APOSC], paras 95 and 98
Regulations 1995, Regulations 9(1) and 12
Although the above standards provide a good basis for evaluation of materials selection they are
not all encompassing and hence the following should in addition be examined:
How has the industry experience been captured and fed into the materials selection
process?
What is being done to design out corrosion under lagging?
Have the various problems with vessel internal coatings experienced by a number of duty
holders been recognised?
Are risks of preferential weld corrosion adequately addressed?
How are the significant erosion risks in vessel sand wash drains tackled?
Are ESD and Control valve trims adequate to maintain seal tightness under the operating
environment?
Are the limitations and problems in using corrosion allowance approach to manage
degradation recognised?
Do provisions for testing include the need to demonstrate adequacy of the materials
corrosion resistance as well as physical properties?
Have the limitations of 316SS tubing been considered in the material selection process?
Are the particular requirements for bolting material and its corrosion protection adequately
addressed?
Sheet G2
Erosion
Sheet G6
Fatigue/Vibration Cracking
Sheet G15
Sheet G20
Sheet G25

None
G26 Thermal Radiation

1. Confirmation should be obtained that requirements for the identification of thermal radiation as
an initiator to other hazardous events have been analysed in accordance with recognised standards
or codes of practice that would be used for a manned installation. Recognised standards/codes
include:
BS EN ISO 13702:1999 Petroleum and Natural Gas Industries Control and Mitigation of fires &
explosions on offshore production installations requirements and guidelines
Spouge, J, A Guide to Quantitative Risk Assessment for Offshore Installations, CMPT (Centre for
Marine and Petroleum Technology), 1999, Appendix IV Hydrocarbon event consequence
modelling (old)
The following document provides useful information but is based on a different regulatory regime,
so should be used with care to ensure consistency withUKlegislation:
judgement as to the adequacy of the evaluation of thermal radiation hazards can only be assessed
on an individual basis, and the duty holder should be required to justify which its
procedures/practices in the relevant areas will deliver an equivalent level of health and safety
performance.
1995
Fire & Explosion Strategy Document http://www.hse.gov.uk/offshore/strategy/index.htm
Thermal radiation sources should be identified using techniques such as HAZOP studies in
conjunction with manufacturers information, and evaluated and recorded as a thermal radiation
hazard.
None
Sheet 2.3.3.F8
Fire Types
Sheet 2.3.3.F10
Fire Modelling
Sheet 2.3.3.F11
Explosion Modelling
Sheet 2.3.3.F28
F1 Generic Historical Data

1. Confirmation: in order for duty holders to estimate the frequency of potential accident scenarios,
data will be required on a range of relevant inputs, ranging from failure of individual parts of the
hydrocarbon containment envelope, [pressure vessels, piping, heat exchangers etc] through to the
probability that alarm and preventative systems or items of equipment such as fire and gas alarms
and components of the shutdown system will fail to operate correctly on demand.
2.
If the frequency estimates produced for the various accident scenarios are to be realistic and
credible it is essential that the data used in deriving them is soundly based and defensible. In many
cases where company or installation specific data [see 2.3.1.F2] is not available estimates will have
to have been produced using generic historical data from across the industry worldwide. This data
will have been produced using a variety of different sources. Potential accident / incident data
sources are described in section 4 of this assessment sheet and include OREDA, E&P Forum,
WOAD, etc.
Assessors should carefully examine the values assigned to the failure rates for different types of
equipment against typical indicative historical values obtained from the accident / incident data
sources listed in section 4 of this assessment sheet. These relevant data sources selected by HSE
include the ED Hydrocarbon Release Database.
Where a duty holder has used a failure rate/probability which differs markedly from the indicative
values obtained from the accident / incident data sources listed in section 4 of this assessment
sheet and where the usage of this figure results in a significantly lower release/accident frequency
being adduced, the duty holder should be requested to provide a detailed justification.
Potential web link to new version of SPC/TECH/ED/24 (Accident / Incident Data)
Offshore Information Sheet No 2 / 2009 - Hydrocarbon Releases (HCRs) Offshore
4.1
Data Categories
The three main categories associated with the typical Offshore risk are:
Category A The probability of occurrence of an unwanted event (i.e. initiating event), for example:
External Events: Vessel Collision, Helicopter Crash, Dropped Objects
Internal Events: Blowout, Process Release, Pipeline/Riser Leak
Category B The conditional probability of occurrence of the effects on the initiating event, for
example:
Effects: Immediate/Delayed Ignition, Accumulation, Dispersion, Safety
Systems: Fire and Gas Detection, ESD, Blowdown
Category C The probability of occurrence of insult/damage given an effect, for example:
Consequences: Jet Fire, Pool Fire, Loss of Life, Capital Loss
4.2
Data Source References
Main Data Sources:

Statistics from the Hydrocarbon Releases (HCR) database, also contained in annual HSD-ED
reports
Statistics from HID ORION database
Offshore Reliability Data (OREDA) 5th edition, 2007
Cox, Lees and Ang, Classification of Hazardous Locations (1993), IChemE
Offshore Blowouts Causes and Control (1997), by Per Holand
Accident Statistics for offshore units on theUKcontinental shelf 1990-2007

Ship/Platform Collision Incident Database (2001)
An Appraisal of Existing Seismic Hazard Estimates for theUKContinental Shelf (2003)
Other Data Sources:
OGP; Risk Assessment Data Directory; March 2010 - Appendix 1 Failure Rates (Report No. 434
A1), Major Accidents (Report No. 434 17), Process Release Frequencies (Report No. 434 1),
Storage Incident Frequencies (Report No. 434 3).
Spouge, J, A Guide to Quantitative Risk Assessment for Offshore Installations, CMPT (Centre for
Marine and Petroleum Technology), 1999, Appendix IX Risk Analysis of Process Leaks (old)
4.3
Main Data Sources

MAIN DATA
Initiating
Conditional
Consequences
Events
Probabilities
SOURCES
External
Internal Hazards
Effects
Hazards
Safety
Systems
Hydrocarbon
Nonhydrocarbon
HSE-ED
Hydrocarbon
Release
Database
HID ORION
Database
X
Offshore
Reliability Data
(OREDA)
Classification of
Hazardous
Locations
Offshore
Blowouts Causes
and Control
Accident
Statistics for
Fixed Offshore
Units on
theUKContinental
Shelf
Accident
Statistics for
Floating Offshore
Units on
theUKContinental
Shelf
Ship/Platform
Collision Incident
Database
UKOffshore
Public Transport
Helicopter Safety
Record
An Appraisal of
Existing Seismic
Hazard
Estimates for
theUKContinental
Shelf
4.4
Key assessment questions
Are the sources of data properly identified?

Is the data relevant to the UK Continental Shelf Oil and Gas Industry?
Is the data sufficiently specified in terms of the type of failure being analysed, and its frequency or
probability?
Is the data the most recent available?
How accurate is the data?
Has experience and/or expert judgement been used to adjust generic frequencies?
Does the frequency used compare favourably with the main data sources (4.3) values?
Do release frequency analyses include hole size distribution?
Has a sensitivity analysis been carried out?
Are the calculation methods for producing estimated data (e.g. release rates, ignition probabilities)
appropriate, and are they being applied property?
Have HAZOP and/or Human Factors been taken into account to justify using generic average data
Has failure frequency data been adjusted down due to a system or equipment either being new, or
near to the end of its design life?
2.3.1.F2
Company and Installation Specific Data

None
F2 Company and Installation Specific Data

1. Confirmation: Enquiries should be made as to whether company or installation specific data is
available and has been used to estimate failure/release frequencies as opposed to reliance on
generic historical data.
2. Company/installation data is preferable to generic data as it is more likely to reflect accurately
the effect of company/installation specific features such as its safety management
policies/practices/ competencies, operating history etc. If it is available but has not been used,
justification should be sought.
Care should be taken where generic data has been employed but has been modified allegedly to
reflect company specific circumstances. Experience suggests that such modifications almost
invariably result in claims for lower than average failure/release rates. Clearly it is an anomalous
situation where every duty holder is apparently better than average and the basis for such claims
should be carefully examined.
Care should also be taken in cases where company/installation data is being used but it indicates
failure/release rates markedly different from the indicative figures obtained from the accident /
incident data sources listed in section 4 of assessment sheet 2.3.1.F1. The basis for any claims of
superior performance needs to be carefully established and examined.
Potential web link to new version of SPC/TECH/ED/24 (Accident / Incident Data)
Offshore Information Sheet No 2 / 2009 - Hydrocarbon Releases (HCRs) Offshore

None
F1
Generic Historical Data

None
F3 Installation Specific Hazard Studies

1. Confirmation should be obtained that installation specific hazard studies have been carried out
in accordance with recognised standards or codes of practice for all operational safety cases.
Normally the hazard studies should include a detailed HAZOP study. Recognised standards/codes
of practice for HAZOP include:
HAZOP: Guide to Best Practice I.Chem.E 2000
IEC 61882:(2001) Hazard and operability studies (HAZOP studies). Application guide
(edition 1.0)
CIA 1977 A Guide to Hazard and Operability Studies (relevant to older installations only).
The HAZOP study could be used in conjunction with other recognised techniques such as:
IEC 60812 (2006) Procedures for failure mode and effects analysis (FMEA) (edition 2.0)
IEC 61025 (2006) Fault tree analysis (FTA) (edition 2.0)

BS EN ISO 17776:2002 Guidelines on tools and techniques for hazard identification and
risk assessment.
BS EN ISO 10418:2003 - Basic surface process safety systems (including in Annex C Safety
Analysis Function Evaluation (SAFE) charts)
API RP 14C Recommended Practice For Analysis, Design, Installation, And Testing Of Basic
Surface Safety Systems For Offshore Production Platforms
Restricting the hazard identification process to high level hazards [fire, explosion, toxic release,
structural failure etc] can be acceptable for design safety cases (provided more detailed work is still
to be carried out) but does not provide the depth or rigour required for operational safety cases.
2. Where a standard/code of practice/methodology other than those listed above has been
employed, judgement as to the adequacy of the hazard studies can only be assessed on an
individual basis and the duty holder should be required to justify why the methods employed will be
equally effective.
3. Factors to note in assessing hazard studies include:
i.
As noted above whilst restricting the identification process to high level hazards or accidents
[fire, explosion etc] may have some justification for design safety cases [where more detailed work
has yet to be carried out] it is of extremely limited value in the operational safety cases context.
Identifying fire as a hazard in a module containing hydrocarbon does nothing to identify ways in
which the hydrocarbon might be released or where and how it might be ignited. Without this
knowledge little can be done to reduce the likelihood of a fire occurring. What is required is a full
examination of the ways in which the release might occur and become ignited, incorporating
consideration of a full range of possible initiating events such as hardware failure, human error etc.
The methodology cited above should provide an appropriate level of insight into the relevant
accident scenarios, with perhaps additional amplification being provided via techniques such as
Fault Tree Analysis for scenarios involving coincidental failure of multiple system components. It is
also important that appropriate detailed hazard identification is applied to all activities taking place
on a particular installation and not just to the more obvious process systems. For example, there
have been instances where the hazard identification for such operations as drilling, workover and
wirelining essentially consisted of noting that blow-out might occur with respect to the equipment,
procedures and operations taking place on the individual installation under consideration.
Maintenance related activities are another area which sometimes only receive fairly peripheral
attention.
ii. The possibility of accidental breakthrough of gas or liquid from a high pressure system to a lower
pressure one needs to be considered as part of the hazard study process. In view of the number of
accidents that have occurred in this manner, it is better if a specific HP/LP interface study has been
carried out to supplement other studies such as HAZOP. It is important that such studies consider
all foreseeable modes of operation.
iii. Confirmation should be sought that all actions and remedial work identified from the hazard
studies have been completed and signed off.
iv. Studies that should be considered and/or undertaken to identify any safety gaps, N.B. studies
should be undertaken in accordance with appropriate guidelines:
a. HAZID & HAZOP,
b. HP/LP interface study.
None
Section 2.4.3 Human and Organisational Factors
Section 2.1.2 Risk Assessment (including Human Vulnerability)
F4 Layout
1. Confirmation should be obtained that the layout has been designed in accordance with a
recognised standard or code of practice. Recognised current standards / codes of practice would
include:
EN ISO 13702 (1999) Petroleum and natural gas industries Control and mitigation of fires
and explosions on offshore production installations Requirements and guidelines.
Particularly section 5 Installation layout
EN ISO 13703 (2000) Petroleum and natural gas industries Design and installation of
piping systems on offshore production platforms. Particularly Section 9.2 Layout
EN ISO 15138 (2007) Petroleum and natural gas industries Offshore production
installations Heating, ventilation and air-conditioning. Particularly section 2.3.3 System
design General; 5.4 Area-specific system design; and the associated Annexes.
ISO 15544 (2010) Petroleum and natural gas industries Offshore production installations
Requirements and guidelines for emergency response. Particularly section 11 - Escape,
refuge, evacuation and rescue and associated Annex F.
Energy Institute (2005) Model Code of Safe Practice Part 15 Area classification code for
installations handling flammable fluids (IP15), 3rd Edition.
Installation layouts may have been designed to the following superseded and obsolete codes
and standards.
API RP 2G (1974) Recommended Practice for Production Facilities on Offshore Structures
API RP 14E (1975 - 1984) Recommended Practice for Design and installation of offshore
production platform piping systems
API RP 14F (1978 1985) Recommended Practice for Design and installation of electrical
systems for offshore production platforms
Withdrawn BS 5345 (1976) Code of practice for the selection, installation and maintenance of
electrical apparatus for use in potentially explosive atmospheres
The above codes, standards and guidance are applicable to the layout of all types of installation
(fixed, FPSO and MODUs).
judgement as to the adequacy of the layout can only be assessed on an individual basis, and the
duty holder should be required to justify why its procedures / practices in the relevant areas will
deliver an equivalent level of health and safety performance.
Equipment and Protective Systems Intended for Use in Potentially Explosive Atmospheres
Regulations 1996 SI 1996/192 NB: These regulations are applicable to fixed installations but do
not apply to MODUs, floating production platforms (FPPs) and floating production storage and
offloading vessels (FPSOs).
4. Specific technical issues:
4.1
The safety case should not merely describe the layout but include arguments and rationale
for: segregation of hazards (APOSC para 71(d)); avoidance of undue complexity (APOSC para 71
(e)); location and routing of risers (APOSC para 71(g)); orientation and spacing of equipment; fire
zones; location of fire walls and blast walls; hazardous area classification; and, ventilation. A layout
HAZOP is an appropriate technique for identifying some of these issues.
On existing installations removal of redundant equipment and removal or redesign of windwalls or
module walls may reduce the potential for accumulation of flammable substances.
4.2 General plant layout should:

a. incorporate the principles of separation and segregation,
b. minimise the risk of loss of containment,
c. reduce the risk of escalation,
d. provide opportunities for mitigation,
e. provide good visibility and escape routes,
f. allow ease of inspection and maintenance,
g. minimise human error.
5. Other related assessment sheets in this Section are:
2.3.1.F10
Concept selection
6. Cross-referenced Sections and Sheets are:

None
F8 Safety Integrity Levels Standards

1. Confirmation should be obtained that the consequence of failure has been identified for all
instrument based protective functions. Where failure of the instrumented based protective function
could lead to death or to serious injury confirmation should be obtained that the consequences of
such failure have been risk assessed in accordance with a recognised standard/code of practice.
Recognised standards include:
EEMUA 222 Guide to the Application of IEC 61511 to safety instrumented systems in
theUKprocess industries (note that the EEMUA 222 guide supersedes the previous UKOOA
Guidelines for Instrument Based Protective Systems)
IEC 61508 Functional safety of electrical/electronic/programmable electronic safety related
systems
IEC 61511 Functional safety. Safety instrumented systems for the process industry sector
BS EN ISO10418 Petroleum and natural gas industries Offshore production installations
Basic surface process safety systems
Safety Integrity Levels [SILs] provide a scale for describing the performance of instrumented
protection systems.
judgement as to the adequacy of the risk assessment can only be assessed on an individual basis
and the duty holder should be required to justify that the methods used will be equally effective as
those in the standards listed.
3. Relevant Legislation, ACOP and Guidance Include:
Management of Health and Safety at Work Regulations 1999, Regulation 3
Offshore Installations (Prevention of Fire and Explosion, and Emergency Response) Regulation
1995 [PFEER] Regulation 5 and 19
4.1
Where a methodology presented in the above standards has been followed but a non
standard calibration/rule matrix [risk graph] has been employed the duty holder should provide a
detailed justification that the non-standard/calibration rule matrix will produce an equivalent level of
safety to that which would be achieved using the standard calibrations/rules.
4.2
Although IEC 61508 permits functions with a SIL greater than SIL 3 any function allocated
above SIL 3 should be avoided where practicable by changes in the process design or adding
diverse layers of protection. SIL 4 safety functions are unlikely to be accepted by the HSE.
4.3
Functions allocated a SIL 3 target should be subject to detailed assessment.
4.4
Systems which should be considered for assessment include:
Ballast systems
Cargo handling systems
Riser disconnect systems
Blowout preventer systems
2.3.1.F16
2.3.1.F18
Shutdown Systems
2.3.1.F19
Alarms and Trip Systems

Section 2.2.2 Stability - Maritime Integrity, Loss of [Ballast systems & cargo handling systems]
Section 2.4.1 Wells - Risk evaluation and management [Blowout Preventers]
F10 Concept Selection

1. Confirmation should be obtained that safety issues have been given prominence in choosing
between different design options and that the selection has not been dominated excessively by
economic considerations. In particular, evidence should be sought that inherently safer principles
as set out in the Management of Health and Safety at Work Regulations 1999, [para 27] and
APOSC, [paras 67, 68 and 71] have been properly taken into account. For new manned, fixed
installations this should always include consideration of providing a separate accommodation jacket
removed from the drilling and production facilities.
Concept selection is an issue which predominately applies at the initial design stage for a new
installation where a number of different design concepts can be identified. On a more limited scale
similar issues are also relevant to the design of additional facilities/modifications for an existing
installation.
2. Notwithstanding the above, whilst ED can and should seek to influence the design toward
inherently safer concepts, it has no specific legal powers in this area and the decision as to which
concept is selected ultimately lies with the duty holder. EDs role thereafter is to ensure that the
risks posed by the chosen design are controlled in accordance with the requirements of the relevant
Management of Health and Safety at Work Regulations 1999, ACOP para 27
Evaluation of different design concepts for a new manned, fixed installation should always include a
separate bridge linked accommodation jacket as a comparator option. This option may not be
reasonably practicable in all cases but there should be clear evidence that it has been carefully
examined and there are sound reasons for its rejection based on ALARP principles.
General process safety principles
The following general process safety principles should be considered in the design of the
installation and its facilities:
a. separation and segregation,

b. diversity and redundancy,
c. availability, functionality, reliability and survivability,
d. a hierarchical approach, starting with inherently safe sign,
then prevention, detection
and control, and finally mitigation,

e. layout to minimise the risk of a major accident from occurring and escalating,
f. consideration of common mode failures.
2.3.1.F14
Inherent Safety

None
F11 Size of Release, Speed of Detection and Effectiveness

1. Confirmation should be obtained that size of release, speed of detection and effectiveness has
been assessed in accordance with a recognised standard or code of practice. Recognised
BS EN ISO 13702:1999 Petroleum and Natural Gas Industries Control and Mitigation of Fires
and Explosions on Offshore Production Installations Requirements and Guidelines.
OGP Risk Assessment Data Directory Report number 434-1, Process release frequencies,
March 2010
OGP Risk Assessment Data Directory Report number 434-3, Storage incident frequencies,
March 2010
judgement as to the adequacy of the analysis of release, speed of detection and effectiveness can
only be assessed on an individual basis, and the duty holder should be required to justify why its
procedures/practices in the relevant areas will deliver an equivalent level of health and safety
performance.
Regulations 1995
4.1
The release sizes used in the analysis should ideally be related to an assessment of
credible failures based on a walk down of the plant/equipment in question and parts count based
on as-built P&IDs.
4.2
Speed of detection and effectiveness will affect potential for escalation.
4.3
Effectiveness of detection should not be based on equipment reliability alone.

2.3.1.F12
Dispersion, Open or Enclosed Modules, Ventilation Rates

Section 2.3.3 Loss of Containment - Fire & Explosion
F12 Dispersion, Open or Closed Modules, Ventilation Rates

1. Confirmation should be obtained that ventilation regimes throughout the platform have been
analysed in accordance with recognised standards or codes of practice. This includes open and
closed modules, as well as open deck area. Recognised standards/codes of practice would include:
BS 5925:1991 Code of practice for ventilation principles and designing for natural ventilation
BS EN ISO 15138:2007 Petroleum and natural gas industries. Offshore production
installations. Heating, ventilation and air-conditioning

judgement as to the adequacy of the installations ventilation regimes can only be assessed on an
Regulations 1995
Local air movement surveys are recommended before any hot work or intrusive maintenance is
carried out to evaluate the local ventilation rate.
Sheet 2.3.1.F11
Size of Release, Speed of Detection and Effectiveness

Sheet 2.3.3.F7
Escalation, Layout Separation, Open/Closed Modules
Sheet 2.3.3.F11
Explosion Modelling
Sheet 2.3.3.F28
F14 Inherent Safety
1. Confirmation should be obtained that inherent safety has been designed into the plant in
accordance with a recognised standard or code of practice. Recognised standards/codes of
BS EN ISO 17776 (2002) Petroleum and Natural Gas Industries Offshore Production
Installations Guidelines on tools and techniques for hazard identification and risk
assessment.
Energy Institute, UKOOA, HSE Guidelines for Management of Safety Critical Elements:2nd
edition 2007 .
Oil and GasUK/ HSE HS025 Fire and Explosion Guidance 2007 (CD format only)
The above codes, standards and guidance are applicable to all types of installation.
judgement as to the adequacy of inherent safety can only be assessed on an individual basis, and
the duty holder should be required to justify why its procedures/practices in the relevant areas will
deliver an equivalent level of health and safety performance. Similar considerations will apply where
the duty holder is unable to demonstrate any systematic considerations of inherent safety
principles.
Offshore Installations (Safety Case) Regulations 2005, Schedule 2, para13. L30 A Guide to
the Offshore Installations (Safety Case) Regulations 2005, HSE Books, (2006), paragraph
23 Regulation 6 and guidance para 136 and Schedule 1 and guidance para 249.
Regulations 1995, Regulations 4 and ACoP para 38. L65 Prevention of Fire and Explosion,
and Emergency Response on Offshore Installations, Approved Code of Practice and
guidance, HSE Books, (1997) Regulation 4 and guidance paragraph 38 and Regulation 9
and guidance paragraphs 87-88.
Management of Health and Safety at Work Regulations 1999, ACoP, para 27. L21
Management of health and safety at work, HSE Books, (2000), Regulation 4, ACOP
paragraph 29, guidance paragraph 30 and Schedule 1.
Assessment Principles for Offshore Safety Cases [APOSC], paras 92, 93, 94, 95 and 98
L85 A guide to the Offshore Installations and Wells Regulations (A Guide to the Integrity,
Workplace Environment and Miscellaneous Aspects of the Offshore Installations and Wells
(Design and Construction, etc) Regulations 1996), HSE Books, (1996), Regulation 5 and
guidance paragraph 32.
OTH 96 521 Improving Inherent Safety

4.1.
During the design stage, which covers concept selection through to detailed design
specification [drawings, calculations, specifications, etc], there is the maximum potential for
reducing risks, by early application of the principles of inherently safer design. For example
consideration should have been given to avoiding offshore processing [process onshore], inventory
minimisation, segregation, complexity reduction, provision of separate accommodation, etc.
4.2.
An installation that is designed and constructed such that risks are controlled to ensure
compliance with the relevant statutory requirements depends to a significant extent on the efforts
applied to achieve inherently safer design at the earliest stages of the project design process. .
4.3
Incorporating the principles of inherent safety implies that installations should preferably be
designed to have fully rated risers, vessels, pipework and pipelines. If the topsides are not fully
rated a hierarchy of over-pressure protection measures should have been considered: full flow
relief; partial relief with instrumented protection system; HIPS, etc.
4.4
General process safety principles. The following general process safety principle should be
considered in the design of the installation and its facilities: a hierarchical approach, starting with
inherently safe design, then prevention, detection and control, and finally mitigation.
2.3.1.F4
Layout
2.3.3.F10
Concept Selection
2.3.3.F16

None
F15 Relief Systems

2.3.1.F15
Relief Systems
1. Confirmation should be obtained that relief systems have been designed and constructed in
accordance with a recognised standard or code of practice. Records standards/codes of practice
would include:
API 520 American Petroleum Institute, Sizing, Selection and Installation of Pressure Relieving Devices in Refineries, Part I (Standard) Sizing and Selection, 8th edition 2008
and Part II (Recommended Practice Installation, 5th edition 2003
API Standard 521 American Petroleum Institute Guide for Pressure-relieving and
Depressuring Systems 5th edition 2007 (ISO 23251 identical)
API Std 526 American Petroleum Institute (2002) Flanged Steel Pressure Relief Valves
API Std 527 American Petroleum Institute (1991) Seat Tightness of Pressure Relief Valves
BS PD5500: 2009 Specification for unfired fusion welded pressure vessels
BS EN ISO 4126, Safety Devices for protection against excessive pressure with parts as:
o Part 1: Safety Valves (BS EN ISO 4126-1:2004),
o Part 2: Bursting Disc Safety Devices (BS EN ISO 4126-2:2003),
o Part 3: Safety valves and bursting disc safety devices in combination (BS EN ISO 4126-3:
2006),
o Part 4: Pilot-operated safety valves (BS EN ISO 4126-4: 2004),
o Part 5 Controlled safety pressure relief systems (CSPRS) (BS EN ISO 4126-5 2004),
o Part 6: Application, selection and installation of bursting disc safety devices (BS EN ISO 4126
-6, 2003),
o Part 7 Common Data (BS EN ISO 4126-7: 2004),
o Part 9 Application and installation of safety devices excluding stand alone bursting disc safety
devices (BS ISO 4126-9: 2008),
o Part 10 Sizing of safety valves for gas / liquid two phase flow (BS ISO 4126-10: 2010).
BS EN 764-7: 2002 Pressure Equipment Part 7: Safety systems for unfired pressure vessels
ASME VIII (2001) Boiler and pressure vessel code
The Institute of Petroleum(2001) Guidelines for the safe and optimum design of hydrocarbon
pressure relief and blowdown systems, ISBN 0 85293 287 1
The Institute of Petroleum(2003) Guidelines for the design and protection of pressure
systems to withstand severe fires, ISBN 0 85293 279 0
The above codes, standards and guidance are applicable to relief systems on all types of
installation [fixed, FPSO and for well test equipment on drilling installations]. Relief systems
associated with plant on new installations and new plant on existing installations should have been
designed to the current version of the above codes and standards. Relief systems on older
installations may have been designed to superseded codes, e.g. BS 1515 Pressure Vessel Code,
BS 2915 Specification for Bursting Discs and Bursting Disc Devices, BS6759-3 Safety valves:
Specification for safety valves for process fluids.
judgement as to the adequacy of the relief systems can only be assessed on an individual basis,
and the duty holder should be required to justify why its procedures/practices in the relevant areas
will deliver an equivalent level of health and safety performance.
3.
Relevant Legislation, ACOP and Guidance Include:

Offshore Installations (Safety Case) Regulations 2005, Schedule 2, para 13

4.1
There are important differences between proportional relief valves/check valves and safety
relief valves. Swagelok proportional relief valves/check valves do not meet the requirements of the
ASME Boiler and Pressure Vessel Code Section VIII. See Product Notice issued by Swagelock
Feb/Mar 2002.
4.2
Failures of bellows in balanced bellows type relief valves have occurred. As a result some
operators have modified the bonnet vents of balanced bellows pressure relief valves rather than
tackling the underlying causes. However, such modifications may adversely affect the valves
performance with serious health and safety consequences.
4.3
A review of lessons learned from past incidents is given in Section 6 of Institute of
Petroleum (2001) Guidelines for the safe and optimum design of hydrocarbon pressure relief and
blowdown systems.
4.4
Modifications to existing facilities may have altered the duty subsequently required of a relief
device or system/subsystem. It is important, therefore, that confirmation is obtained that potentially

affected relief duties/devices have been reassessed as part of the design of the modifications.
4.5
Editions of API 521 later than the 5 th edition (2007) will have improved guidance on the
relief systems required to deal with severe fires. Suitable fire relief vents can be designed for pool
fires but not for jet fires. For jet fires a blowdown system is required instead. Information partly
based on the IP publication Guidelines for the design and protection of pressure systems to
withstand severe fires is being incorporated into an Annex (Determination of Fire Requirements) of
later API 521 editions.
4.6
Different methods to deal with two-phase flow (involving gas/liquid and vapour/liquid
mixtures) are included in API 520 and ISO 4126 Part 10. API 520 uses a rigorous version of the
Homogeneous Equilibrium Method (HEM), which requires integration of thermodynamic physical
property data. ISO 4126 Part 10 uses an approximate version of HEM known as the Omega
method, which requires less physical property data. If mixture physical property data is available as
a function of temperature and pressure then the rigorous HEM approach (API 520 two-phase flow
method) is preferred.
4.7
Design Requirements for Relief, Vent and Flare Systems
The following would be expected in relief vent and flare systems design:
a. sizing basis: relationship to blowdown and relief philosophy and sizing for maximum
coincident flows,
b. sizing of PSV and pipework for discharge composition, flowrate and conditions including
multi-phase flow,
c. blowdown system to meet (or better) API RP 521 requirements for reducing pressure.
Should also consider jet fire risks and need to enhance blowdown rate,
d. residence time for knock-out and separation in accordance with recognised codes and
standards,
e. robust level control and alarms and pump-out system to prevent overfill,
f. consideration of overfilling from heat exchanger cooling medium, and systems to detect and
control such an event,
g. design to allow operators to react to and control and over-fill event,
h. layout of relief, vent and flare pipework to minimise the likelihood of damage from fire,
explosion and dropped objects,
i. location of flare to prevent excessive thermal radiation and rain-out of flammable liquids onto
the installation,
j. purging system to prevent air ingress under all reasonably foreseeable conditions.
2.3.1.F16
2.3.1.F17
Blowdown/Flare System
2.3.1.HS17
FlareTowers

None
F16 High Integrity Protection Systems (HIPS)

1. Confirmation should be obtained that the HIPS has been designed to recognised
standards/codes of practice. Recognised standards include:
theUKprocess industries
systems
HIPS provide an instrumented means of protecting plant & equipment from conditions outside the
design basis. Normally this will relate to excess pressure although it could relate to extremes of
temperature [hot or cold]. HIPS are sometimes also referred to as HIPPS [high integrity pressure
protection system] or OPPS [overpressure protection system].
judgement as to the adequacy of the HIPS can only be assessed on an individual basis. In these
cases the duty holder should be required to justify why the methods employed will result in an
equivalent level of safety to that required in the referred standards.
Regulations 1995, Regulation 5, 9 and 19
Provision and Use of Work Equipment Regulations 1998, Regulation 18 and Guidance paras
272-275
SPC/TECH/ED/31 Safety instrumented systems for the overpressure protection of pipeline
risers
4.1
The duty holder should be required to demonstrate that an inherently safer alternative to
HIPS is not reasonably practicable.

4.2
Where there are interdependencies between HIPS equipment and emergency shutdown
equipment the HIPS performance detailed assessment may be required to establish whether the
claimed benefits of the HIPS can be fully realised.
4.3
Where fast HIPS response [<10 seconds] is required detailed assessment may be required
to confirm the required response time has been properly established and that HIPS performance
can be readily verified.
4.4
Where the HIPS is to be located subsea detailed assessment may be required because of
the limited field experience in this environment.

4.5
Generally functions implemented by HIPS will have a target SIL of 2 or 3. Targets lower
than these may be reasonable but may require detailed assessment to confirm the suitability of the
performance standard.
4.6
The use of software for the central logic of any SIL 3 HIPS is novel in the UKCS and outside
the recommendations in the EEMUA 222 Guidelines. It is preferred that SIL 3 safety functions are
implemented using non-programmable logic. Where this is not the case then the duty holder
should provide a detailed justification for such software and the justification should be subject to
detailed assessment.
2.3.1.F8
2.3.1.F14
Inherent Safety
2.3.1.F18
Shutdown Systems

None
F17 Blowdown/Flare Systems

1. Confirmation should be obtained that blowdown and flare and vent systems have been
designed and constructed in accordance with a recognised standard/code of practice. Recognised
API RP 521 American Petroleum Institute (1997) Guide for Pressure Relieving and
Depressuring Systems
The Institute of Petroleum (2001) Guidelines for the Safe and Optimum Design of
Hydrocarbon Pressure Relief and Blowdown Systems ISBN 0 85293 287 1
TheInstituteofPetroleum(2003) Guidelines for the design and protection of pressure systems
to withstand severe fires, ISBN 0 85293 279 0
The above codes, standards and guidance are applicable to blowdown flare systems on all types of
installation [fixed, FPSO and for well test equipment on drilling installations].
judgement as to the adequacy of the blowdown/flare systems can only be assessed on an
Offshore Installations (Safety Case) Regulations 2005, Schedule 2 para 13
4.1
Staggered or staged blowdown of sections of plant may be specified where the flare/vent
system capacity is limited. The assumptions on which the design is based and any philosophy for
the order in which sections of plant undergo blowdown should be clear. Where plant modifications
have occurred confirmation should be obtained that checks have/will be carried out to confirm that
stagings and timings are still achievable.
4.2
Tie-in of new developments may impose higher flows and lower temperatures on existing
relief and vent systems. The impact of these conditions and the implications of any mitigating
measures, eg staged blowdown, temperature trips to inhibit blowdon, should have been addressed.
4.3
A detailed reliability study should have been undertaken on closed flare or vent systems.
The assumptions on which the design is based should be clear. The IVB should have had an
opportunity to comment on and influence the design. It is likely that an actuated block valve in
parallel with a bursting disc will have an overall probability of failure on demand [PFD] of about 2E04 and therefore be SIL3. Three devices in parallel: block valve, bursting disc and buckling pin
valve, with a PFD of ~2E-06, have been used by some duty holders. To achieve these levels of
reliability annual or more frequent testing of all systems should be specified. The implementation of
these test intervals would be a suitable topic for post-acceptance inspection. See sheet 2.3.1.F16
on HIP systems.
4.4
A review of lessons learned from past incidents is given in Section 6 of Institute of
Petroleum Guidelines for the safe and optimum design of hydrocarbon pressure relief and
blowdown systems. This guide includes checklists for assessment of relief and blowdown
systems [pp 100-102] for both designers and operators.
4.5
If a locked open valve is located downstream of a blowdown valve/restriction orifice, the
pipework up to and including the locked open valve should be rated at the full pressure of the
upstream system. The locked valve can be used to test the functionality of the BDV without blowing
down the plant. In these circumstances the pipework downstream of the orifice may fail if it is rated
for the lower pressure of the flare system.
Editions of API 521 later than the 5 th edition (2007) will have improved guidance on the
4.6
relief systems required to deal with severe fires. Suitable fire relief vents can be designed for pool
fires but not for jet fires. For jet fires a blowdown system is required instead. Information partly
based on the IP publication Guidelines for the design and protection of pressure systems to
withstand severe fires is being incorporated into an Annex (Determination of Fire Requirements) of
later API 521 editions.
4.7
The Design Requirements for Relief, Vent and Flare Systems are covered as a specific
technical issue in section 2.3.1 F15 Relief Systems.

2.3.1.F15
Relief Systems
2.3.1.F16
2.3.1.HS17 FlareTowers
None
F18 Shutdown Systems

1. Confirmation should be obtained that shutdown systems have been designed to recognised
standards/code of practice. Recognised standards for trip systems include:
systems
Shutdown systems provide an instrumented means of protecting plant and equipment from
conditions outside the design basis. By isolating inventories and effecting blowdown they also
provide means for mitigating some of the hazards arising following loss of containment.
judgement as to the adequacy of the protection systems can only be assessed on an individual
basis. In these cases the duty holder should be required to justify why the methods employed will
result in an equivalent level of safety to that required in the referenced standards.
Regulations 1995, Regulation 12 and 19
4.1
Where the shutdown function includes shutting subsea wells and the subsea wellhead
valves do not close on loss of communication with the host platform the design should be
subject to detailed assessment.
4.2
Where the closure of an import ESDV could lead to pressure exceeding the design
pressure of the corresponding import pipeline the design should be subject to detailed
assessment
4.3
Where the ESD equipment has not been subject to a survivability analysis the
design should be subject to detailed assessment.

2.3.1.F8
2.3.1.F16

None
F19 Alarm and Trip Systems

1. Confirmation should be obtained that alarm and trip systems have been designed to recognised
standards/codes of practice.
Recognised standards for alarm and trip systems include:

systems
Recognised standards for alarm systems include:
EEMUA 191 Alarm Systems - A Guide to Design, Management and Procurement
Better Alarm handling- HSE Chemicals information sheet No 6
Trip systems provide an instrumented means of protecting plant and equipment from conditions that
could lead to circumstances outside the design basis. Alarm systems provide a means of warning
operators that plant conditions are deviating significantly from normal or for alerting operators to
take mitigating action after an incident. Trip systems shutdown items of plant when significant
deviations from normal occur.
judgement as to the adequacy of the alarm/trip system can only be assessed on an individual basis
and the duty holder should be required to justify why the methods employed will result in an
equivalent level of safety to a design which is in compliance with the reference codes and
standards.
Regulation 1995 [PFEER] Regulation 19
1.
4.1
Specific Technical Issues:

If there are situations on process plant where an operator response to an alarm condition is
required to prevent conditions exceeding the design basis of the plant then the process plant design
does not follow the principles of inherently safer design. In such cases the duty holder should be
required to justify in detail why none of the inherently safer options is reasonably practicable.
4.2.
For an alarm system to function properly there must be an effective interface to the process
operator. EEMUA Document 191 addresses ergonomic issues relating to alarm presentation and
information overload. A detailed assessment of this area will involve consideration of human
factors.
2.3.1.F8
2.3.1.F16
2.3.1.F18
Shutdown Systems

Section 2.4.3 Human and Organisational Factors
F23 Isolations
1. Confirmation should be obtained that isolation procedures are in accordance with recognised
standards or codes of practice.
2. Where another standard/code of practice has been employed, judgement as to the adequacy
can only be made on an individual basis and the duty holder should be requested to justify why
equivalent standards of safety should result.
Assessment Principles for Offshore Safety Cases [APOSC], para 72
The safe isolation of plant and equipment (2nd edition 2006) HSE, HSE Books, HSG253
Loss of Containment Manual Part 4 Isolations and Permits to Work
Design Requirements for Isolations
The following would be expected in isolations design:
a. design-in of isolation requirements, e.g. provision for positive isolations, double block and bleed,
spading points etc.
b. fail safe ESD valves,
c. acceptable closure times and leakage rates, the latter based on the ability of the plant to contain
leakage,
d. located for ease of inspection, testing and maintenance,
e. appropriate fire protection,
f. consideration of common mode failures, e.g. loss of actuating medium.

None
None

Loc Process

Enviado por

Dados do documento

Direitos autorais

Formatos disponíveis

Compartilhar este documento

Compartilhar ou incorporar documento

Opções de compartilhamento

Você considera este documento útil?

Este conteúdo é inapropriado?

Direitos autorais:

Formatos disponíveis

Loc Process

Enviado por

Direitos autorais:

Formatos disponíveis

LOSS OF CONTAINMENT - PROCESS

Assessment of Adequacy of Demonstration

management in conjunction with the contents of the Categorisation Table below:

vibration cracking standards /

& audit systems

G10 - Inadequate F9 - Equipment

selection [eg weld

HS17 Flare and

Flare and vent

G19 - Missile [eg

HS1 Pressure Vessels (including Columns)

Pressure Equipment Regulations 1999, Regulations 7 and 10

Primary & Secondary Loads

Issues for Safety Case Assessment

Issues for Safety Case Assessment

Dropped Loads G17]

Issues for Safety Case Assessment

High Integrity Protection Systems [HIPS]

6. Cross-Referenced Sections and Sheets are:

HS2 Heat Exchangers

Shell and Tube Heat Exchangers

Printed Circuit Heat Exchangers

Gasketed Plate Heat Exchangers

Brittle failure due to the formation of titanium hydrides

Design Requirements for Heat Exchangers

The following would be expected in heat exchanger design:

Pressure Vessels (Including Columns)

6. Cross-Referenced Sections and Sheets are:

Venting for Fire Exposure and In/Out Breathing

part of a wider consideration of an inherently safer design features.

Methanol Storage Tanks

Design Requirements for Atmospheric Vessels

The following would be expected in atmospheric vessel design:

7. Cross-Referenced Sections and Sheets are:

HS4 Centrifuges / Hydrocyclones

Pressure Vessels (Including Columns)

6. Cross-Referenced Sections and Sheets are:

HS6 Smallbore Tubing

5. Other Related Assessment Sheets in this Section are:

HS8 Flexible Hoses

HS13 Gas Treatment Plant

Small bore tubing

Ageing / material degradation

Incorrect material specification and usage

Size of release, speed of detection and effectiveness

6. Cross-Referenced Sections and Sheets are:

HS15 Hazardous Drains / Caisson

Assessment Principles for Offshore Safety Cases [APOSC] paras 14 and 35

Dip Pipe Perforation

Design Requirements for Open and Closed Drains

The following would be expected in open and closed drains design:

c. maintaining appropriate slopes to achieve drainage,

HS17 Flare and Vent Towers

4. Specific Technical Issues:

6. Cross-Referenced Sections and Sheets are:

HS18 Mechanical Integrity of FPSO Mooring Turrets

General description of turret systems

Turret system design

Fluid transfer systems

Inspection and maintenance

Examples of good and bad practice

HS19 Temporary Equipment

4. Specific Technical Issues:

Deciding what is, and is not, temporary equipment