Every year, SPE organizes more than 30 conferences worldwide.

Critical issues of
current interest to the oil industry are reflected in the SPE papers presented at these
conferences. When selecting papers for this feature, I was not surprised that many
papers deal with topics related to safety in facilities design and to asset integrity.
With recent publicized accidents and the industrys continuing concern about
its public image, operating companies are focusing on process safety and improv-
ing asset integrity, and are addressing these issues early in facilities design.
Indeed, it can be argued that enhancing safety performance and dealing with
the increased environmental risks remain the key challenges facing the industry
today. Some concepts relevant to these topics are briefly outlined.
Asset integrity can be defined as the ability of the asset to perform its required
function effectively and efficiently while managing health, safety, and the envi-
ronment. In this context, asset integrity refers to hydrocarbon systems and
includes support systems and infrastructure, such as platform structures.
Critical safety elements are those systems and equipment that prevent, control,
or mitigate major accidents. They include elements such as pressure-relief valves,
shutdown systems, fire- and gas-detection systems, and firefighting equipment.
Safety instrumented systems (SISs)since its publication in 2003, the
International Electrotechnical Commission (IEC) 61511 standard is becoming the
basis for the specifications and implementation of SISs in the oil industry. Initially,
the industry was relatively slow to adopt this standard. A dilemma facing operat-
ing companies is what to do about the existing shutdown safety systems that were
installed before 2003 and that are not in compliance with IEC 61511.
Papers selected for this feature along with those recommended for additional
reading highlight industry progress in these issues. I hope that they will be of
interest to you.
Production Facilities additional reading
available at OnePetro: www.onepetro.org
SPE 146240 The Practical Application of Process Safety Principles To
Determine and Monitor Asset Integrity of Oil and Gas Facilities by John
Hopkins, WGPSN.
SPE 141174 Replacement of Existing ESD Valves With New SIL Rated
ESD Valves: A Case Study of Production Optimization and Enhancement of
Process Safety and Integrity in Kuwait Oil Company by Sadoun Mutar Bezea
Al-Khaledi, Kuwait Oil Company, et al.
SPE 137461 Corrosion Management of a Worldwide Existing Pipeline
Network by Michel Bonis, Total S.A., et al.
Production Facilities
TECHNOLOGY FOCUS
66 JPT DECEMBER 2011
JPT
Hisham Saadawi, SPE, is Vice
President (Engineering) for Abu Dhabi
Company for Onshore Oil Operations
(ADCO). He has more than 30 years
experience in the design, construction,
startup, and operation of oil- and gas-
processing facilities. Saadawis current
areas of interest include multiphase
pumping, CO
2
enhanced oil recovery,
technical safety, as well as training and
development. He is a recipient of the
2011 SPE Regional Projects, Facilities,
and Construction Award. Saadawi is a
20102011 SPE Distinguished Lecturer
and an SPE course instructor. He has
served on several committees and sub-
committees of SPE conferences and
workshops, and he serves on the JPT
Editorial Committee. Saadawi holds a
PhD degree in mechanical engineering
from the University of Manchester, UK,
and is a Chartered Engineer in the UK.
JPT DECEMBER 2011
67
The safety of an onshore facility is
a function of how safely the facil-
ity was designed. People are injured,
and sometimes killed, when explosions,
fires, and toxic-gas releases occur at oil-
and gas-producing facilities that were
designed without including measures
that could have prevented such inci-
dents. The safety of people and equip-
ment must be considered and included
along every step in the engineering and
design of oil and gas facilities.
Introduction
Many wellsites, tank batteries, and pro-
duction facilities are at risk because of
design or installation errors. These errors
may have occurred when the facility was
built or because the facility had been
enlarged or upgraded through the years.
Lack of proper engineering design can
lead to equipment failure, lost produc-
tion, human injury, or harm to the envi-
ronment. Design and equipment selec-
tion will affect the safety and health of
perhaps generations of workers who will
be working on and near the equipment.
Safe Facilities
When designing a facility for a discov-
ery, companies may choose to make
sure that all facilities are designed and
operated in accordance with standards
and good engineering practices and
with regulatory requirements. The other
choice is to make decisions that inevita-
bly lead to equipment failure, personnel
injuries, and environment al damage.
The full-length paper details 12 key
areas for facility designers and engineers
to include when designing facilities for
safe operation. The following is a short
summary of these areas that should
enable designing and building safe
facilities that reduce the risk of major
incidents. See the full-length paper for
citing of applicable recommended prac-
tices, codes, and standards.
Design-Standards Policy. Each pro-
ducing company, no matter how small,
must implement a policy regarding the
use of industry design standards that
can be articulated to the production
and operations groups regarding how
surface facilities should be built. Setting
a design policy to use industry stan-
dards will reduce the risk of injury to
personnel or the occurrence of an envi-
ronmental event at the facility. Most
industry standards and regulations
were developed in response to safety-
related events and continually evolve to
incorporate lessons learned from other
safety-related events. Building a facility
to industry standards provides the user
with industry-accepted safety criteria.
Site Layout for Safety. One of the
first tasks when building a new facility
is to lay it out on the pad properly. In
planning the equipment layout, one
must obtain a plot plan of the site and
a list of the equipment to be installed.
Start with placement of the most-haz-
ardous items on the sitevents; flares;
fired process equipment; engines and
rotating equipment; separators, tanks,
and unfired vessels; and site offices,
electronic control equipment, batteries,
and electrical switchgear.
Design Piping Properly. To design a
safe and reliable facility, it is impera-
tive that the piping system be designed
properly. Because upstream oil and gas
facilities are not covered specifically by
codes, it is the users responsibility to
select the applicable piping code. Codes
for process piping and for materials used
in H
2
S-containing environments in oil
and gas production are applicable.
Proper Pressure Vessel. Pressure ves-
sels are generally defined as those hav-
ing an internal pressure greater than
15 psig and an inside diameter great-
er than 6 in. The US Department of
Labor Occupational Safety and Health
Administration (OSHA) set rules that
require pressure vessels used in flam-
mable- and combustible-liquid service
to be built in accordance with the code
for unfired pressure vessels set forth
by the American Society of Mechanical
Engineers (ASME).
The manufacturers nameplate,
which should remain affixed perma-
nently to the pressure vessel, must
display the U stamp as an indica-
tion that the design, fabrication, and
testing were conducted in accordance
with that code. To maintain the integ-
rity of pressure vessels, they must be
inspected periodically. Vessels repaired
or rerated as a result of an inspection,
should have an additional nameplate
added with an R stamp displayed.
Picking the Proper Tank. According to
OSHA, there are two types of tanks used
in upstream oil and gas operations. Low-
pressure tanks have a maximum allow-
able working pressure (MAWP) of 0.5
to 15 psig, with OSHA requirements that
are very similar to those for pressure ves-
sels. Atmospheric tanks have an MAWP
of 0 to 0.5 psig and must be used only for
storage of crude petroleum.
Specifying Rotating Equipment for
Safety. Centrifugal pumps can be used
This article, written by Senior Technology
Editor Dennis Denney, contains high-
lights of paper SPE 141974, Twelve
Steps To Engineering Safe Oil and
Gas Facilities, by J.E. Johnstone,
SPE, and J.V. Curfew, SPE, Contek
Solutions, prepared for the 2011 SPE
Americas E&P Health, Safety, Security,
and Environmental Conference, Houston,
2123 March 2011. The paper has not
been peer reviewed.
Twelve Steps To Engineering Safe Oil and Gas Facilities
PRODUCTION FACILITIES
For a limited time, the full-length paper is available free to SPE members at www.jptonline.org.
68 JPT DECEMBER 2011
in severe service (defined as hydro-
carbon liquids in a high-temperature
environment) or can be used in less-
rigorous service where intrinsic reli-
ability and high-temperature service
are not required. The discharge piping
of the pumps should be equipped with
a relief valve to prevent overpressuring
of downstream piping, a check valve
to prevent backflow, and a high-/low-
pressure switch to alert operators in the
event of a problem with the discharge.
In light-hydrocarbon or -crude service,
a shut-in valve should be installed
on the pump inlet. This safety device
can close off flow to the pump in the
event of a leak or fire downstream of
the pump.
Internal-combustion reciprocating
gas engines follow standards for report-
ing engine-horsepower ratings. Engine
ratings are degraded by ancillary equip-
ment (e.g., fans and pumps), altitude,
ambient temperature, and fuel compo-
sition. The engineer should work with
the engine manufacturer to determine
the available horsepower in accordance
with those standards. Engines should
have shutdown systems for situations
that will harm the engine or associ-
ated processes.
Reciprocating compressors are cat-
egorized as low- to moderate-speed
compressors (typically in the 300-
to 700-rev/min range) or as high-
speed compressors (typically 900
to 1,800 rev/min and used in field
compression applications). All pres-
sure vessels connected to compressors
must be protected with relief valves
on the compressors. Generally, these
relief valves are placed on the inlet
scrubber(s) and downstream of each
stage of compression.
Electric-motor enclosure types, insu-
lation systems, and ratings for winding-
temperature rise must be specified to
standards for general-purpose indus-
trial alternating-current squirrel-cage
induction motors. Within these stan-
dards, descriptions are provided for
various classifications of protection for
motor enclosures. In general, there
are two primary categoriesopen and
totally enclosed.
Relief-System Design. The purpose of
a relief system is to protect piping and
equipment from excessive overpres-
sure. Relief devices must comply with
the appropriate ASME vessel codes,
and relief systems must comply with
state and federal laws and codes. In
addition to safety, state and federal
regulations cover environmental con-
siderations. A concern that should be
addressed early in the design is whether
a relief system is necessary or if atmo-
spheric vents are acceptable. This deci-
sion should be made primarily on the
basis of the type of fluids being handled
and public exposure.
Relief-system design begins with
criteria for individual relief devices.
Initial considerations are set pressure,
allowable overpressure, and relief-
capacity requirements. Overpressure
is the pressure increase beyond the
set pressure of the primary relieving
device. For single-relief-device sys-
tems, the set pressure of the device
can be no higher than the MAWP of
the system. For multiple-device sys-
tems, supplemental devices may be
set higher than the MAWP, the exact
set pressure being determined by the
purpose for the additional capacity of
the device. Normally, the allowable
overpressure is 10% of the set pressure
and is a consideration when evaluating
the size for a relief device. Depending
on the relieving scenario, the overpres-
sure can vary from 10 to 21%.
Electrical-Area Classification. Elec-
trical equipment is used increasingly to
automate remote facilities. Solar panels
have brought electricity to remote pro-
duction facilities, and personnel are
carrying more electronic equipment,
such as cell phones and lap-top com-
puters, which usually are nonclassi-
fied, as part of their work. Along with
the increase in the number of electri-
cal devices is the need to ensure that
installed equipment meets the require-
ments of hazardous locations.
Hazardous locations generally are
classified in one of two divisions for the
oil and gas industry. Class-I, Division-1
locations are defined as locations where
ignitable concentrations of flammable
gases or vapors can exist under nor-
mal operations, may exist frequent-
ly because of repair or maintenance
or because of leakage, or may exist
because of equipment breakdown that
simultaneously causes the equipment
to become a source of ignition.
Class-I, Division-2 locations are
defined as locations where volatile flam-
mable liquids or flammable gases or
vapors exist, but normally are confined
within closed containers; where ignit-
able concentrations of gases, vapors, or
liquids normally are prevented by posi-
tive mechanical ventilation; or loca-
tions adjacent to a Class-I, Division-1
location where ignitable concentrations
might be communicated occasionally.
Many sites have been observed at
which low-voltage automation systems
have been installed; however, these sys-
tems often are not rated for classified
areas. In many instances, this equip-
ment has been used in other industries
and has not yet been rated for hazard-
ous locations. Personnel also need to
recognize that carrying a nonclassi-
fied device into a classified area is in
violation of code.
Instrumentation and Control Sys-
tem. Instrument alarms and shutdown
systems provide the first level of safety
in the event that a process upset has
occurred. Control systems that use pro-
grammable-logic controllers, distribut-
ed-control systems, and supervisory-
control and data-acquisition systems
have improved facility safety greatly
by enabling advanced logic in safety
systems and by making it easier to
add alarm and shutdown points. Safety
systems can be examined in terms of
levels of protection to prevent or mini-
mize the effects of equipment failure
within the process. Generally, facilities
are built to have at least two levels of
protection. Having two levels of safety
enables safe operation in the event
that one of the protection means fails
to operate as designed. The two levels
should be independent and in addition
to the control devices being used in the
normal process operation.
Personnel Safety. Personnel safety at
the oil and gas site must be examined
to ensure that employees do not place
themselves at risk while performing
routine operations and to ensure that
the site conforms to OSHA require-
ments. OSHA regulations provide
excellent guidance when designing
walking surfaces, exit routes, stairways,
ladders, elevated platforms, and equip-
ment guarding.
Process-Hazard Analysis. A process-
hazard analysis is a systematic method
to identify and analyze potential haz-
ards associated with a facility. The goal
of the analysis should be to recommend
necessary design changes to make
the facility safe during abnormal or
JPT DECEMBER 2011 69
unplanned operating conditions. Each
facility should be designed to ensure
that personnel, the environment, and
equipment are safe if control equip-
ment fails (e.g., liquid-dump valves and
pressure regulators), human operating
errors occur (e.g., turning the wrong
valve or tank overflows), or mechanical
equipment fails (e.g., compressor-valve
or pump-seal failure). The design also
should account for risk from natural
causes (e.g., rain, freezing weather, or
change of wind direction).
Results of the process-hazard anal-
ysis should include findings, a risk
ranking of the findings, and recom-
mendations to resolve those findings.
Recommendations should be followed
up with a list showing the party respon-
sible for making corrections and the
time frame in which the corrections
must be made.
Additions or changes to the facil-
ity that might affect safety or materi-
ally change the process-hazard analysis
must be reviewed. Companies often
use a management-of-change pro-
cess to ensure that changes do not
degrade safety systems already in place
at the facility.
Design Verification and Commission-
ing. The prestartup safety review is
a formal process to ensure that each
component and system in a facility is
checked thoroughly and is ready to be
brought into service. It is customary to
use checklists so that nothing is over-
looked and so that signoff can be per-
formed as each section is completed.
The checklists focus attention on each
key item and usually assign respon-
sibility for completion. It is impor-
tant that all disciplines be involved so
that no detail is overlooked. Therefore,
checklists are as extensive as necessary
for the particular facility, but not so
detailed that they become cumbersome
and ineffective. In the signoff process,
any individual or group has the ability
to delay startup until the issue of con-
cern is resolved.
Summary
Many incidents and injuries can be
prevented if production facilities are
designed properly. The first step is to
obtain management buy-in that all
injuries are preventable and that the
companys facilities should be built to
good industry practices and regula-
tory requirements.
Recommended practices, codes, and
standards for building safe facilities
are readily available. Most of these
items were first conceived after a major
incident and have continued to evolve.
Engineers and operations personnel
need to take time to acquaint them-
selves with these recommended prac-
tices, codes, and standards to be com-
fortable with their use.
After the facilities are built, there are
two steps that should be taken. The first
is conducting some type of process-
hazard analysis to ensure that all of the
needed safety systems are in place and
that the operations personnel are not
placed at risk. The second step is to con-
duct a prestartup safety review to ensure
that the piping, tanks, engines, pumps,
and compressors have been installed
as planned. JPT
Whatever abrasive, high-pressure, high-
volume operation you have planned
for your completion, youre going to
want packing thats up to the task.
Our well service packing solutions are
engineered to keep you up and running
through it all. Count on us.
www.TuffBreed.com
70 JPT DECEMBER 2011
The main objectives of independent
verification are to help substantiate
that current oil and gas best prac-
tices are used; to provide assurance
that facilities have been designed to
operate safely throughout their life-
time; and to ensure that all health,
safety, and environmental risks
have been managed to acceptable
and as-low-as-reasonably-practicable
(ALARP) levels. Independent verifica-
tion anticipates the lack of applicable
laws or standards, especially in new
environments. This approach, initially
introduced in the UK after the Piper
Alpha disaster in 1988, is becoming an
industry standard.
Introduction
A prescriptive approach to safety and
environmental management of offshore
installations relies on a selection of
specific regulatory requirements devel-
oped for all phases from design to
decommissioning, which are imposed
by a regulator. The owners of the off-
shore installations must follow exist-
ing standards, practices, guidelines,
and procedures. The same regulator
will evaluate the compliance through
review, auditing, and inspections of
plans, permits, and related documents.
Relying on this approach alone has
revealed several disadvantages.
The regulator must understand and
be capable of keeping up with evolv-
ing technologies and practices used
in the offshore industry to update the
requirements and evaluate compliance.
The maintenance of detailed regula-
tory requirements on how to construct
safe installations or operate them prop-
erly is resource intensive, and these
requirements lag behind best indus-
try practices.
The owner of offshore installations
must be completely knowledgeable in
the regulations (or lack thereof) of each
country in which it operates.
The owner of offshore installations
is responsible only for complying with
individual regulatory requirements.
Particularities of each offshore in
-
stalla tion are not considered and, as
such, may not be analyzed as a whole,
within the context in which they
operate.
Complex working situations occur
on offshore installations, possibly creat-
ing dangerous conditions that must be
examined carefully and organized in
the best way possiblethe details of
which cannot be foreseen in a prescrip-
tive approach.
Goal-Setting Approach
The goal-setting approach was intro-
duced through Lord Cullens 1990
report on the Piper Alpha disaster.
Instead of imposing rules, the regula-
tor proposed specific quantifiable goals
that the offshore installations owners
must meet. Hence, the owners have
flexibility on how they will meet these
goals. An important change is that the
responsibility for managing safety and
environmental aspects rests on the
duty holder, which is either the owner
or the operator of the offshore instal-
lation. The goal-setting approach does
not exclude prescriptive regulations.
Often, hybrid solutions use elements
from both goal-setting and prescrip-
tive approaches.
UK Offshore Installations
(Safety Case) Regulation
Lord Cullens report was adopted in
1992 in The Offshore Installations
(Safety Case) Regulationslater re-
vised in 2005and several support-
ing regulations. Named the Safety
Case Regulations (SCR), it describes a
framework of activities that are either
required or implied to demonstrate the
safety of installations. The duty holder
demonstrates its intention to manage
its installations safely through safety
cases and by proving achievement of
the regulators goals. Key steps that
support the safety case are presented in
the following subsections.
Identification of Major-Accident
Hazards (MAHs). To define the safety
goals for an installation, the first step
comprises identifying MAHs. The SCR
defines a major accident as:
Fire, explosion, or the release of a
dangerous substance involving death
or serious personal injury
Any event involving major damage
to the structure of the installation or
loss of its stability
Collision of a helicopter with the
installation
Accidents linked to diving activities
Any other event arising from a
work activity involving death or serious
personal injury to five or more persons
The duty holder can extend this defi-
nition with additional requirements,
such as environmental concerns or
economical or reputation effects.
Strategy for Risk Reduction. UK regu-
lations require a hierarchy of strategies
for managing and reducing risk from
MAHs and adherence to the ALARP
principles. Hence, this step comprises
finding ways to reasonably reduce the
risk for each MAH. A typical risk-
management hierarchy prioritizes risk-
This article, written by Senior Technology
Editor Dennis Denney, contains highlights
of paper SPE 136392, Independent
Verification of Safety-Critical Elements,
by Julien Marty, Sophie Theys, SPE,
Christian Bucherie, Andy Bolsover,
and Philippe Cambos, Bureau Veritas,
prepared for the 2010 SPE Russian Oil &
Gas Technical Conference and Exhibition,
Moscow, 2628 October. The paper has
not been peer reviewed.
Independent Verification of Safety-Critical Elements
PRODUCTION FACILITIES
For a limited time, the full-length paper is available free to SPE members at www.jptonline.org.
72 JPT DECEMBER 2011
management actions. The strategy to
reduce risk must ensure the following.
All staff understand their exposure
to risk and are aware of emergency
responses
All risks are eliminated, controlled,
or mitigated to levels that are ALARP
All MAHs and risks are monitored
and managed through a systematic
approach
Identifying Safety-Critical Elements
(SCEs). To avoid MAHs or to mitigate
them, the duty holder will develop a
list of SCEs applicable to its installa-
tion. The SCEs are defined as parts
of the installation or its operational
organization for which their failure
could cause or contribute substantially
to a major accident, and their purpose
is to prevent or limit the effect of a
major accident.
Production of Performance Stan-
dards (PSs). The next step comprises
expressing, in qualitative or quantita-
tive terms, the performance required
for each SCE. This can relate to items
of equipment, persons, or procedures.
These PSs define the following criteria
for each SCE.
Functionality
Availability
Reliability
Survivability
Interdependency
It is in the PSs that the duty holder
can set prescriptive requirements, and
they can be standards with which the
SCE should conform.
Assurance. The duty holder will per-
form assurance activities to confirm
that the installation meets the require-
ments of individual PSs during design
and throughout the operational life-
time of the installation. At the design
stage, such assurance is undertaken
by the duty holder through the use
of appropriate codes and standards,
best practices, risk-based approaches,
design reviews, peer checks and senior-
engineer approvals, and third-party
interventions by suitably qualified,
experienced, and competent persons.
Assurance activities during the opera-
tional phase include inspection, test,
and maintenance.
Verification. Underpinning the safety
case will be the verification scheme, a
mandatory part of the UK SCR. The
verification can be defined as a system
of independent and competent scrutiny
of the suitability of SCEs throughout
the asset life cycle. The whole process
of identifying SCEs, producing PSs,
and performing assurance is monitored
and verified by an independent compe-
tent person (ICP). The duty holder is
responsible to select the independent
verification body (IVB) and screen its
ICPs. Verification is a sampling process
and includes document review, checks
by calculation, physical examination,
testing, or witnessing of tests, audit,
and confirmation of records during the
life of the asset.
Other Commonwealth Countries
Australia has been regulating offshore
installations since 1967, and the lat-
est update to safety management has
been ratified and published under the
name of Offshore Petroleum (Safety)
Regulations 2009 (OPSR). The prin-
ciples behind the Australian OPSR are
very similar to those of the UK SCR, in
that OPSR requires the following.
An owner or titleholder must nom-
inate one person for each facility
The safety case must be accepted
by the safety authorityincludes the
same steps of hazards identification,
risks assessment, technical measures to
reduce risk, and monitoring of continu-
ous improvements and implementation
The ALARP concept is used
Revisions of the safety case are per-
formed every 5 years
The safety case must contain a
detailed description of the safety-man-
agement system that accounts for all
hazards and risks to personnelnot
just for major-accident events (equiva-
lent to the UK MAH). Hence, a large
part of the safety case should be dedi-
cated to occupational health and safety,
including diving operations.
Similarly, New Zealand has formal-
ized the need for a health, safety,
and environment case as described in
Schedule 4 of its Health and Safety in
Employment (Petroleum Exploration
and Extraction) Regulations 1999.
Again, the inclusion of potential
hazards to/from the environment
extends the goal-setting approach
beyond hazards to persons. Self-
monitoring and -reporting are the rec-
ommended practice.
In Canada, the National Energy
Board, the Canada-Nova Scotia
Offshore Petroleum Resources, and
the Canada-New Foundland Offshore
Petroleum Resources gathered all regu-
lations in December 2009 under the
Canada Oil and Gas Operations Act
(COGOA). Previously, the National
Energy Board established a goal-setting
approach that was declined in each
of the provinces and territories with
offshore installations. Still, the prov-
inces have established implementation
acts following the COGOA that have
a more-prescriptive nature. In addi-
tion, the issuance of a certificate of
fitness for each installation by a certi-
fying authority (five of them are cited)
is required.
Other Adopted Approaches
While the UK, Australia, and New
Zealand require the acceptance of a
safety case and the intervention of
an IVB, other countries have opted
for varying solutions to ensure that
safety and environmental management
are taking place. Also, companies that
historically have been linked to UK
activities may opt for the goal-setting
approach as an integral part of their
safety-management system.
Country. Norway considers the accep-
tance of a safety case or similar docu-
ment by a regulator as a very resource-
demanding exercise and, accordingly,
does not require that step. However,
Norway does require the same risk
assessment and description of how
the operator intends to control identi-
fied risks. These documented assess-
ments and calculations must be avail-
able to the Norwegian government
(Petroleum Safety Authority, the State
Pollution Control Agency, or the
Health Directorate) at any time. The
operator can, however, elect individu-
ally to perform a safety case and have
it verified by an independent body.
Traditionally, the USA has had no
legal requirements for a safety- and
environmental-management sys-
tem. Instead, its national regulator
suggested programs based on the
American Petroleum Institute (API)
Recommended Practice 75 (API RP 75).
API RP 75 recommends a manage-
ment program that covers 11 areas
especially management of changes in
personnel and facilities, establishment
of operating procedures, and a strong
emphasis in establishing goals and
performance measures. Its application
is limited to well drilling, servicing,
JPT DECEMBER 2011
and production; pipeline facilities;
and facilities that may have significant
safety and environmental effects. The
International Association of Drilling
Contractors has produced goal-setting
guidelines specific to mobile offshore
drilling units.
However, following the Deepwater
Horizon drilling-rig explosion, the
USA divided management of resourc-
es, oversight on safety and environ-
ment, and management of assets into
separate entities. At the time of writing
the original paper, the recommended
practices were being changed to rules,
requiring implementation of a safety-
and environment-management system
(SEMS) covering hazard analysis, man-
agement of change, operating proce-
dures, and mechanical integrity, with
possible needs for audits. API RP 75
may be turned into a prescriptive regu-
lation for offshore installations.
Owner or Operator. Several com-
panies have adopted the goal-setting
approachspecifically the safety case
as described by the UK SCRfor
their offshore installations outside the
North Sea or Australia. It also may be
applied to onshore facilities. Owners
and operators that develop activities
in new countries gain confidence in
their project by voluntarily following
a goal-setting approach. It helps them
maintain their exposure to risk at
similar levels, wherever they operate,
and for whichever assets and fields
they operate. It encourages their engi-
neers to think through design aspects
critically instead of relying only on
prescriptive requirements, especially
when engineers are not familiar with
local requirements. In these cases,
owners and operators often follow the
local mandatory prescriptive approach
but also follow, on a voluntary basis,
a goal-setting approach to gain confi-
dence in their asset designs.
Observations
Several Russian oil and gas develop-
ments are in harsh, Arctic, offshore,
and/or sensitive environments. State
regulations covering health, safety,
and environmental management are
in place. However, there are two main
aspects that can be of concern.
These developments involve for-
eign companiesoperators and con-
tractorswho are unfamiliar with
Russian requirements and are con-
cerned by the gap between what they
know as common practice and what is
required by the country.
These developments involve Arctic
features such as climate and seasonal
variations, water- and atmospheric-cir-
culation patterns, and effects of cold or
ice on materials and personnel that will
change the construction and operation
parameters greatly as well as the work-
ing conditions. Those extreme con-
ditions often stretch the application
of industrial standards outside their
intended envelope.
The intervention of the IVB is rec-
ommended, particularly in the case
of a voluntary adoption of the goal-
setting approach. It has access to expe-
riences of different operators and dif-
ferent installations in many environ-
mental settings, and it can be an aid to
the regulator unfamiliar with the goal-
setting approach. Again, the indepen-
dent competent personnel involved in
the safety and environment verifica-
tion should be different from those
performing the business verification.
Introducing the Goal-Setting Ap-
proach Into Regulation. To intro-
duce the goal-setting approach into
law, a country may need to consider
the following.
The roles of the regulator and
industry participants must be defined
clearly and divided in such a way that
the responsibilities are known from
the outset.
The number of regulators should
be limited. In particular, the body
responsible for management of hydro-
carbon resources (hence, hydrocarbon
production) should be distinct from
the regulatory body responsible for
safety and/or environment.
In the case of a federationsuch
as Russiathe regulator must ensure
that the goal-setting approach and the
regulatory structure agree on the same
approach at all levels of the nation.
The regulator should set essential
safety goals (keeping in mind that
the operator is entirely responsible
for implementing safety and envi-
ronmental management) and refer
to industry guidelines and standards
for their application. This point pre-
vents development of detailed and
narrowly scoped regulations that can-
not deal with the range of situations
that may occur in a rapidly changing
industry.
JPT
Visit our online bookstore at
www.spe.org/store
SPE
Bookstore
www.spe.org/store
NEW TITLE
Low Invasion Coring
J.B. Bloys and H.R. Warner Jr.
The latest addition to SPEs Monograph Series,
Low Invasion Coring will help readers develop
an understanding of how to apply the array of
technologies required for successful completion
of a low-invasion-coring (LIC) project. This
monograph addresses the principles of obtaining
low-invasion cores and provides essential
practical tips for engineering eld LIC projects.
Appendices provide detailed information on
specic core-analysis procedures.
Contents:1SFQMBOOJOHt-PXJOWBTJPODPSJOH
CJUTFMFDUJPOt0UIFSEPXOIPMFIBSEXBSFt
-PXJOWBTJPODPSJOHnVJETt3JHTJUFPQFSBUJPOT
t$PSJOHQPPSMZDPOTPMJEBUFETBOETUPOFt$PSF
analysis
Appendices include: Summaries of selected
41&QBQFSTDPODFSOJOH-*$UFDIOPMPHJFTt4QFDJBM
circumstancessponge coring and the use of
OPOJOWBEJOHDPSFHFMt*NQBDUPGPJMCBTFENVE
on connate water saturation and other rock
properties
74 JPT DECEMBER 2011
Safety-critical-element (SCE) life-
cycle management involves identify-
ing major accident hazards (MAHs);
selecting SCEs by identifying structures
and plants that can cause, contribute
to, prevent, or help recover from a
major accident event; and develop-
ing the performance standards (PSs)
for the identified SCEs. It also involves
alignment of maintenance routines,
inspection and testing, performance
history, and other tasks required to
maintain the SCE in a suitable con-
dition. Continual monitoring of the
status of the hardware barriers and
performance-assurance tasks enables
the operating staff and management
to analyze the ongoing conformance of
the SCEs by use of their PSs.
Introduction
Although much has been achieved by
the oil and gas industry in terms of
reducing risk to personnel, the envi-
ronment, and assets by use of SCEs
and PSs, major accidents continue to
happen. The concepts of SCEs and
PSs have been presented to prevent or
reduce the number of major accidents.
MAHs or major events are defined dif-
ferently in different parts of the world,
but have a common underlying theme
in that they can cause harm to multiple
people, cause substantial environmen-
tal damage, or cause expensive damage
to the assets. The author highlight-
ed three headline events in the full-
length paper to promote thought on
the topic: the Montara wellhead-plat-
form blowout in 2009, the Deepwater
Horizon accident in 2010, and the
Ocean Ranger semisubmersible sink-
ing in 1982. These events suggest that,
perhaps, not enough is being done and,
therefore, more effort must be made to
reduce the number of major accident
events or possibly prevent them.
Need for SCEs
Reliable Design and Engineering (Good
Practices). SCEs and their PSs ensure
that new installations or designs con-
form to current good practice and reli-
able engineering. For new installations,
it is extremely important that their
design be robust and that they be able
to perform their intended functions
throughout their design life.
Aging Installations. As current oil and
gas installations get older, it is impor-
tant to ensure that they remain capable
of performing intended functions in the
safest manner possible to avoid harm
to personnel or to the environment.
SCEs and their life-cycle-management
processes help achieve these goals and
reduce or prevent the major accidents.
Identifying SCEs
The following methods are used by the
industry to identify SCEs.
Standard Companywide Checklist.
Some oil and gas operators use a com-
panywide checklist to identify SCEs.
This method helps maintain consis-
tency of the approach within various
installations of the company.
Typical-Installation-Specific Check-
list. On the basis of existing knowl-
edge of the type of installation (e.g.,
floating production, storage, and
offloading vessels or mobile offshore
drilling-rig units), SCE-identification
checklists are prepared and used for
new installations.
Comprehensive Risk Assessment.
Comprehensive risk assessment is the
best-practices approach to identify-
ing SCEs and involves detailed iden-
tification of all hazards related to the
design, construction, commissioning,
operation, and decommissioning of the
installation under consideration. This
assessment is achieved by performing
several hazard-identification exercises
involving competent and experienced
multidiscipline teams. One useful tool
This article, written by Senior Technology
Editor Dennis Denney, contains highlights
of paper SPE 140727, Performance
Standards for Safety-Critical Elements
Are We Doing Enough?, by Rahul Dhar,
SPE, Abbott Risk Consulting, prepared for
the 2011 SPE European Conference on
Health, Safety, and Environmental in Oil
and Gas Exploration and Production,
Vienna, Austria, 2224 February. The
paper has not been peer reviewed.
Performance Standards for Safety-Critical Elements
Are We Doing Enough?
PRODUCTION FACILITIES
For a limited time, the full-length paper is available free to SPE members at www.jptonline.org.
Fig. 1Scenario as a sequence of events.
Prevention
Barriers
Control and
Mitigation
Barriers
Hazard Outcome
(e.g., thermal, overpressure, toxic,
missiles, stability, or pollution)
Central
Critical Event
H
a
z
a
r
d
s
I
n
i
t
i
a
t
i
n
g

E
v
e
n
t
s
Incident
Damages Escalation Consequences Causes
JPT DECEMBER 2011 75
to document information from these
hazard-identification workshops is a
bowtie. Bowties are graphical rep-
resentations that provide information
related to the hazardous item/activity.
Threats that could release a hazards
potential are shown on the left-hand
side, and consequences are shown on
the right-hand side. On each threat
branch, barriers are shown that are
control measures to prevent the threat
from arising. Similarly, on each conse-
quence branch, mitigation barriers and
recovery-control measures are shown
that could reduce risk from the con-
sequences. Fig. 1 shows the barriers
(SCEs) on the left and right side of a
central critical event.
Relationship of MAHs, SCEs,
PSs, and Verification Activities
SCEs can be grouped into barriers that
prevent or limit the consequence of a
major accident. Each barrier may con-
sist of one or more SCEs, which can
be broken down into components and
finally into individual equipment-tag
numbers. PSs were specified for all
identified SCEs and divided into two
groups as follows.
PSs that ensure the initial suitabil-
ity of SCEs in the design/construction/
commissioning phase.
PSs that ensure ongoing suitability
of SCEs in the operational phase.
PSs detail the following for each iden-
tified SCE.
The goal of the SCE
The functional-performance re -
quire ment for functionality, availabil-
ity, reliability, and survivability
Dependencies on other SCEs
Detailed pass/fail acceptance criteria
by which SCE performance will be mea-
sured and recorded
Reference material from which the
acceptance criteria are derived
The PSs are aligned carefully to
ensure that they relate directly to the
avoidance or mitigation of MAHs. A
verification and examination plan for
SCEs details the process undertaken
in identifying the SCEs, preparing PSs,
verifying tasks for ensuring their suit-
ability, and arranging for maintenance
of records.
Challenges and Possible Solutions
Several challenges could be encountered
during SCE-life-cycle management.
Content of the PSs. PSs, or perfor-
mance-based standards, should be veri-
fiable measures that provide qualitative
targets and quantitative measures of a
prescribed minimum level of perfor-
mance. The major benefit of perfor-
mance-based standards is a focus on
what must be done rather than on what
should be done, as is the case with more-
prescriptive regimes. However, with this
system, the completeness, accuracy,
and correctness of the content of the
PSs are the responsibility of the person
who writes them. Moreover, there is no
industrywide consensus on what should
be included as a minimum in the PS.
Performance Criteria. The perfor-
mance criteria stipulated for SCEs are
based mostly on recognized indus-
try standards. However, in many
instances, there are no clear criteria
available in these recognized industry
standards. The result is a challenge,
which, in many cases, can be resolved
by use of the manufacturers informa-
tion as criteria.
Maintenance Verification and Test
Frequency. In a report by the UK
For more information, please contact International Petroleum Technology Conference (IPTC)
c/o SPE Asia Pacific Office (Kuala Lumpur)
Suite 23-02, Level 23, Centrepoint South, Mid Valley City Lingkaran Syed Putra, 59200 Kuala Lumpur, Malaysia
Tel: 60.3.2288.1233; 60.3.2182.3000 Fax: 60.32282.1200; 60.3.2182.3030 E-mail: iptc@iptcnet.org
Technology and Operational Excellence:
Keys to Sustainable Global Energy
Registration Deadline
23 January 2012
www.iptcnet.org/2011
RESCHEDULED 79 February 2012
Bangkok Convention Centre at CentraIWorId Bangkok, ThaiIand
Host Organisation: Supported by: Ofcial Airline: Sponsored by:
Society of Petroleum Engineers
SCAN ME TO
DOWNLOAD NOW
76 JPT DECEMBER 2011
Health and Safety Executive, substan-
tial maintenance backlog of SCEs was
identified. To ensure that the system
works, it is important to ensure that
correct maintenance verification and
test frequency are allocated to the SCE.
With the lack of industry standards
on test frequency, standards are some-
times assumed and then monitored for
effectiveness. The best practice is to use
the risk-based approach to identify the
optimum maintenance-verification and
test-frequency requirements of the SCE.
Also, it is possible that the understand-
ing of the technical authority with respect
to maintenance verification is different
from that of the maintenance operator
who actually performs the tasks. To
make the process successful, it is impor-
tant that technical-authority knowledge
is passed to workers on the shop floor.
Training of the maintenance operator
that is specific to the maintenance verifi-
cation of the SCE should be an important
part of the SCE-management process.
Maintenance-Management System.
Integration of SCE management into the
overall maintenance-management sys-
tem of the installation can pose a chal-
lenge when the SCEs are retrofitted into
the overall maintenance-management
system. It is important to use a system,
such as a traffic-light system, to monitor
the status (health check) of the SCE.
Grading SCEs. Grading SCEs assists
in prioritizing maintenance tasks on
the basis of associated risks. However,
sometimes, the grading process itself
can pose a challenge because the main-
tenance team might keep delaying
maintenance of a lower-graded SCE. It
is important to note that even the failure
of lower-graded SCEs can result in a
major accident.
Entire Installation Becomes Safety
Critical. It is important to identify SCEs
on the basis of MAH scenarios. The
tendency to include every part and all
equipment of the installation in the SCE
list should be avoided because it will
defeat the purpose of the entire exercise.
System-Custodian Verification. Veri-
fication challenges include training the
system custodians and technical authori-
ties, interaction between system custo-
dian and maintenance operator, identify-
ing expectations of the system custodian
and ambiguities in performance criteria,
working backward to specify only those
criteria that seem to be achievable by the
maintenance manager, and budget con-
straints and lack of resources.
Availability/Reliability of SCEs. The
best approach in specifying availability
and reliability targets for the SCEs is use
of a risk-based method by performing
safety-integrity-level calculations. For
older installations that begin the pro-
cess of identifying SCEs and PSs later in
the operations phase, this information
might be unavailable. Therefore, it is
recommended that operational experi-
ence be used to identify failure rates and
that the safety-integrity-level calcula-
tions then be performed considering the
quantitative risk assessments completed
for the installation.
Passing/Failing Criteria. To avoid
ambiguity, PSs should have clear pass/
fail criteria. This method would assist
the verification operator in document-
ing results clearly, which could be used
for further analysis of the performance
of the SCE.
68 March 2012
San Diego, California, USA
Town & Country Resort & Convention Center
www.spe.org/events/dc
Register Now
Society of Petoleum Engineers
www.spe.org
International Association
of Drilling Contractors
www.iadc.org
JPT
EQUIPMENT MATTERS
If you play to win, not just any tool
will do. When the stakes are high
and the pressures on, call TAM.
Zonal isolation is what we do. No
matter your downhole challenge,
from cementing to stimulation and
anything in between, chances are,
weve seen it and solved it with
custom-engineered packers and
completion solutions. We are your
caddy, your pro and your greatest
fan in the worlds most challenging
rounds of oil and gas production.
To learn more about how
equipment matters, please visit
www.tamintl.com/equipment
www.tamintl.com