Vous êtes sur la page 1sur 34

Guidelines for the management of

safety critical elements

2nd edition

An IP Publication

Published by the Energy Institute

This document is issued with a single user licence to the EI registered subscriber: goke.akintola@petrofac.com
IMPORTANT: This document is subject to a licence agreement issued by the Energy Institute, London, UK. It may only be used in accordance with
the licence terms and conditions. It must not be forwarded to, or stored, or accessed by, any unauthorised user. Enquiries: e:pubs@energyinst.org t:
+44 (0)207 467 7100
GUIDELINES FOR THE MANAGEMENT OF
SAFETY CRITICAL ELEMENTS

Second edition

March 2007

This document is issued with a single user licence to the EI registered subscriber: goke.akintola@petrofac.com
IMPORTANT: This document is subject to a licence agreement issued by the Energy Institute, London, UK. It may only be used in accordance with
the licence terms and conditions. It must not be forwarded to, or stored, or accessed by, any unauthorised user. Enquiries: e:pubs@energyinst.org t:
+44 (0)207 467 7100
This document is issued with a single user licence to the EI registered subscriber: goke.akintola@petrofac.com
IMPORTANT: This document is subject to a licence agreement issued by the Energy Institute, London, UK. It may only be used in accordance with
the licence terms and conditions. It must not be forwarded to, or stored, or accessed by, any unauthorised user. Enquiries: e:pubs@energyinst.org t:
+44 (0)207 467 7100
GUIDELINES FOR THE MANAGEMENT OF
SAFETY CRITICAL ELEMENTS

Second edition

March 2007

Published by
ENERGY INSTITUTE, LONDON
The Energy Institute is a professional membership body incorporated by Royal Charter 2003
Registered charity number 1097899
Endorsed by
The United Kingdom Offshore Operators Association and the HSE Offshore Safety Division

This document is issued with a single user licence to the EI registered subscriber: goke.akintola@petrofac.com
IMPORTANT: This document is subject to a licence agreement issued by the Energy Institute, London, UK. It may only be used in accordance with
the licence terms and conditions. It must not be forwarded to, or stored, or accessed by, any unauthorised user. Enquiries: e:pubs@energyinst.org t:
+44 (0)207 467 7100
The Energy Institute gratefully acknowledges the financial contributions towards the scientific and
technical programme from the following companies:

BG Group Murco Petroleum Ltd


BHP Billiton Limited Nexen
BP Exploration Operating Co Ltd Saudi Aramco
BP Oil UK Ltd Shell UK Oil Products Limited
Chevron Shell U.K. Exploration and Production Ltd
ConocoPhillips Ltd Statoil (U.K.) Limited
ENI Talisman Energy (UK) Ltd
ExxonMobil International Ltd Total E&P UK plc
Kuwait Petroleum International Ltd Total UK Limited
Maersk Oil North Sea UK Limited

Copyright © 2007 by the Energy Institute, London:


The Energy Institute is a professional membership body incorporated by Royal Charter 2003.
Registered charity number 1097899, England
All rights reserved

No part of this book may be reproduced by any means, or transmitted or translated into a machine language without
the written permission of the publisher.

The information contained in this publication is provided as guidance only and while every reasonable care has been
taken to ensure the accuracy of its contents, the Energy Institute cannot accept any responsibility for any action taken,
or not taken, on the basis of this information. The Energy Institute shall not be liable to any person for any loss or
damage which may arise from the use of any of the information contained in any of its publications.

The above disclaimer is not intended to restrict or exclude liability for death or personal injury caused by own
negligence.

ISBN 978 0 85293 462 3


Published by the Energy Institute

Further copies can be obtained from Portland Customer Services, Commerce Way,
Whitehall Industrial Estate, Colchester CO2 8HP, UK. Tel: +44 (0) 1206 796 351
e: sales@portland-services.com

Electronic access to EI and IP publications is available via our website, www.energyinstpubs.org.uk.


Documents can be purchased online as downloadable pdfs or on an annual subscription for single users and
companies. For more information, contact the EI Publications Team.
e: pubs@energyinst.org.uk

This document is issued with a single user licence to the EI registered subscriber: goke.akintola@petrofac.com
IMPORTANT: This document is subject to a licence agreement issued by the Energy Institute, London, UK. It may only be used in accordance with
the licence terms and conditions. It must not be forwarded to, or stored, or accessed by, any unauthorised user. Enquiries: e:pubs@energyinst.org t:
+44 (0)207 467 7100
CONTENTS

Page

Foreword . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . vii

Acknowledgements . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . viii

1 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1

2 Background to the revision of Guidelines for the management of safety critical elements . . . . . . . . . . . 3

3 Applicable legislation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5

4 Definitions and key concepts . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7


4.1 Safety critical elements . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7
4.2 Major accidents . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7
4.3 Performance standards . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7
4.4 Verification schemes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7
4.5 Independent competent persons . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7

5 Identification of SCEs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9

6 Development of Performance Standards . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13

7 Assurance of SCE integrity . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15

8 Verification throughout the asset life . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 17


8.1 Overview of verification . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 17
8.2 Verification in the concept, feed, design, construction and commissioning phases . . . . . . . . . . . . . . . 18
8.3 In-service verification . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 19
8.4 Decommissioning . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 20

9 Change management . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 21
9.1 Modifications . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 21
9.2 Temporary equipment . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 21

10 References and glossary of terms . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 23

This document is issued with a single user licence to the EI registered subscriber: goke.akintola@petrofac.com
IMPORTANT: This document is subject to a licence agreement issued by the Energy Institute, London, UK. It may only be used in accordance with
the licence terms and conditions. It must not be forwarded to, or stored, or accessed by, any unauthorised user. Enquiries: e:pubs@energyinst.org t:
+44 (0)207 467 7100
vi

This document is issued with a single user licence to the EI registered subscriber: goke.akintola@petrofac.com
IMPORTANT: This document is subject to a licence agreement issued by the Energy Institute, London, UK. It may only be used in accordance with
the licence terms and conditions. It must not be forwarded to, or stored, or accessed by, any unauthorised user. Enquiries: e:pubs@energyinst.org t:
+44 (0)207 467 7100
FOREWORD

In 2005, the UKOOA led Installation Integrity Working Group (IIWG) requested that the Energy Institute manage
the review and revision of the UKOOA Guidelines for the management of safety critical elements, first issued in
September 1996. This project required the formation of a separate (sub) Working Group from the parent IIWG
members.

The revision exercise was part of a programme of work undertaken by the IIWG which included development and
promotion of industry good practices and suitable performance measures. A principal deliverable of this Working
Group was the Asset Integrity Tool Kit, which includes an Assurance and Verification Tool outlining the
requirement for identification, assurance and verification of Performance Standards for Safety Critical Elements.
These Guidelines are therefore considered as providing valuable input for this element of the management of
installation integrity.

It is intended that these Guidelines should provide good practice for the management of safety critical elements for
offshore installations and will be of use principally for those involved in assurance and verification. The document
should also provide a useful guide for duty holders, managers of operations, safety, engineering and maintenance
functions, and an initial introduction for those who wish to become involved in the subject.

This document has been compiled as guidance only and while every reasonable care has been taken to ensure the
accuracy and relevance of its contents, the Energy Institute, its sponsoring companies, the document writer and the
Working Group members listed in the Acknowledgements who have contributed to its preparation, cannot accept
any responsibility for any action taken, or not taken, on the basis of this information. The Energy Institute shall not
be liable to any person for any loss or damage which may arise from the use of any of the information contained in
any of its publications.

These Guidelines will be reviewed in future and it would be of considerable assistance for any subsequent revision
if users would send comments or suggestions for improvements to:

The Technical Department,


Energy Institute,
61 New Cavandish Street,
London
W1G 7AR

e: technical@energyinst.org.uk

vii

This document is issued with a single user licence to the EI registered subscriber: goke.akintola@petrofac.com
IMPORTANT: This document is subject to a licence agreement issued by the Energy Institute, London, UK. It may only be used in accordance with
the licence terms and conditions. It must not be forwarded to, or stored, or accessed by, any unauthorised user. Enquiries: e:pubs@energyinst.org t:
+44 (0)207 467 7100
ACKNOWLEDGEMENTS

The Institute wishes to record its appreciation of the work carried out by the following individuals:

Tim Walsh of Lloyds Register EMEA, for the drafting of this document.

Members of the Joint Industry Working Group, which was set up to steer the re-drafting programme and who have
provided valuable expertise:

Keith Hart Energy Institute (Manager and Chairman)


Lee Broadley Talisman Energy Ltd
Simon Brown HSE OSD
Bernard Emery HSE OSD
Peter Griffiths HSE OSD
Paul Kefford Chevron
Bob Kyle UKOOA
Alex Macleod Lloyds Register EMEA
Bill McKenzie BP Operating Company Ltd
Alan Richardson HSE OSD
Ian Wright DNV

Assistance was also provided by:

Garry Mannett BV
Richard McCabe BV
Phil Rothie BV
Ruth White DNV

The Institute also wishes to recognise the contribution made by those who have provided comments on the Draft
document which was issued during an industry consultation period.

viii

This document is issued with a single user licence to the EI registered subscriber: goke.akintola@petrofac.com
IMPORTANT: This document is subject to a licence agreement issued by the Energy Institute, London, UK. It may only be used in accordance with
the licence terms and conditions. It must not be forwarded to, or stored, or accessed by, any unauthorised user. Enquiries: e:pubs@energyinst.org t:
+44 (0)207 467 7100
1

INTRODUCTION

The purpose of this document is to provide industry document then describes the process by which SCEs are
guidance for the management of Safety Critical identified and performance standards set. The process of
Elements (SCEs) on offshore installations operating on verification is central to ensuring that the integrity of
the UK continental shelf. SCEs are the equipment and SCEs is maintained and guidance is provided for the
systems which provide the basis to manage the risks management of verification throughout the various
associated with Major Accident Hazards (MAHs). This stages of the asset lifecycle. The document also deals
document should be read in conjunction with the with the management of change in relation to SCEs and
Offshore Installations (Safety Case) Guidelines. This concludes by identifying sources of further information
publication replaces that of the same title produced by including good practice and FAQs.
the UK Offshore Operators Association (UKOOA) in This document is aimed at all those who have an
1996. interest and/or involvement in the management of SCEs,
The starting point for this guidance is a review of particularly those responsible for the management of
the applicable legislation and a summary of the key technical and operational activities within, or on behalf
concepts underpinning the management of SCEs. The of, duty holders.

This document is issued with a single user licence to the EI registered subscriber: goke.akintola@petrofac.com
IMPORTANT: This document is subject to a licence agreement issued by the Energy Institute, London, UK. It may only be used in accordance with
the licence terms and conditions. It must not be forwarded to, or stored, or accessed by, any unauthorised user. Enquiries: e:pubs@energyinst.org t:
+44 (0)207 467 7100
GUIDELINES FOR THE MANAGEMENT OF SAFETY CRITICAL ELEMENTS

This document is issued with a single user licence to the EI registered subscriber: goke.akintola@petrofac.com
IMPORTANT: This document is subject to a licence agreement issued by the Energy Institute, London, UK. It may only be used in accordance with
the licence terms and conditions. It must not be forwarded to, or stored, or accessed by, any unauthorised user. Enquiries: e:pubs@energyinst.org t:
+44 (0)207 467 7100
2

BACKGROUND TO THE REVISION OF


Guidelines for the management of safety
critical elements
The first issue of the joint industry Guidelines for the These include:
management of safety critical elements was produced by
a UKOOA led work group in September 1996, at a time — Major modifications being carried out to existing
when the new "verification regime" was being installations as they are developed for changing
introduced. That document was primarily intended to field characteristics and functions, which may be
provide guidance to the industry on how the new very different to those for which they were
requirements should be implemented on installations originally designed.
that had been designed, constructed and operated under — Replacement of verification aspects of the Offshore
the previous "certificate of fitness" requirements. Installations (Design & Construction) Regulations
The UK oil and gas industry has been operating in (1996) by the Offshore Safety Case Regulations
accordance with the requirements of the Offshore Safety (2005).
Case Regulations (OSCR) since 1996 and it is — Installations that are being operated well beyond
appropriate that the original guidelines should be their original design life.
revised to take account of experience gained in recent — Changing ownership, and in some cases, multiple
years. Since the publication of the original guidelines, changes of ownership, of many older assets and the
there have also been additional developments from prevalence of smaller independent operators, some
within industry which have impacted on the of whom are new entrants to the UK sector.
management of safety critical elements and for which — The increasing importance of decommissioning
guidance is provided in this document. activities.

This document is issued with a single user licence to the EI registered subscriber: goke.akintola@petrofac.com
IMPORTANT: This document is subject to a licence agreement issued by the Energy Institute, London, UK. It may only be used in accordance with
the licence terms and conditions. It must not be forwarded to, or stored, or accessed by, any unauthorised user. Enquiries: e:pubs@energyinst.org t:
+44 (0)207 467 7100
GUIDELINES FOR THE MANAGEMENT OF SAFETY CRITICAL ELEMENTS

This document is issued with a single user licence to the EI registered subscriber: goke.akintola@petrofac.com
IMPORTANT: This document is subject to a licence agreement issued by the Energy Institute, London, UK. It may only be used in accordance with
the licence terms and conditions. It must not be forwarded to, or stored, or accessed by, any unauthorised user. Enquiries: e:pubs@energyinst.org t:
+44 (0)207 467 7100
3

APPLICABLE LEGISLATION

The requirement for industry to manage SCEs is — The Offshore Installations (Prevention of Fire and
covered either directly or indirectly by the following Explosion and Emergency Response) Regulations
regulations: 1995 (PFEER).

— The Offshore Installations (Safety Case) The following table shows how these regulations relate
Regulations 2005. to the management of SCEs.

Regulations Section Areas covered


OSCR 2005 Regulation 2 Definition of Safety Critical Elements
Definition of Major Accident Hazards
Assurance of the fitness for purpose of SCEs
Independent Competent Persons
Regulation 19 Duty holders’ responsibility with respect to the
identification and management of SCEs
Schedule 7 Matters to be provided for in a verification scheme
PFEER 1995 Regulation 5 Performance Standards
Regulation 19 Assurance of the fitness for purpose of SCEs

This document is issued with a single user licence to the EI registered subscriber: goke.akintola@petrofac.com
IMPORTANT: This document is subject to a licence agreement issued by the Energy Institute, London, UK. It may only be used in accordance with
the licence terms and conditions. It must not be forwarded to, or stored, or accessed by, any unauthorised user. Enquiries: e:pubs@energyinst.org t:
+44 (0)207 467 7100
GUIDELINES FOR THE MANAGEMENT OF SAFETY CRITICAL ELEMENTS

This document is issued with a single user licence to the EI registered subscriber: goke.akintola@petrofac.com
IMPORTANT: This document is subject to a licence agreement issued by the Energy Institute, London, UK. It may only be used in accordance with
the licence terms and conditions. It must not be forwarded to, or stored, or accessed by, any unauthorised user. Enquiries: e:pubs@energyinst.org t:
+44 (0)207 467 7100
4

DEFINITIONS AND KEY CONCEPTS

There are a number of definitions and key concepts its purpose.


which are essential to the successful management of It is a requirement that Performance Standards
SCEs. Details of these are provided within the should be established for all SCEs.
regulations, approved codes of practice and guidance
documents; however the main concepts are summarised
below. 4.4 VERIFICATION SCHEMES

Verification schemes are written schemes implemented


4.1 SAFETY CRITICAL ELEMENTS to confirm, or otherwise, that SCEs are suitable and
remain in good repair and condition. As from April
Safety Critical Elements are any part of the installation, 2006 verification schemes should also cover specified
plant or computer programmes whose failure will either plant required by PFEER and previously subject to
cause or contribute to a major accident, or the purpose PFEER written schemes of examination.
of which is to prevent or limit the effect of a major
accident, and for the purpose of these guidelines,
include items of specified plant referenced in 4.5 INDEPENDENT COMPETENT PERSONS
Regulation 19 of PFEER.
Independent Competent Persons (ICPs) are required to
carry out various functions under the verification
4.2 MAJOR ACCIDENTS scheme to ensure that the process of managing risks
associated with the Major Accident Hazards is working
Major accidents are fires, explosions or releases of effectively. It is a requirement that ICPs must be
dangerous substances that will cause death or serious sufficiently independent so as to be impartial and
injury; major damage to the structure or plant or loss of objective in their judgement such that safety is not
stability; the collision of a helicopter; failure of life compromised. The role of the ICP can either be
support systems for diving operations; or any other undertaken by a single organisation or by a number of
event involving death or serious injury to five or more different individuals or organisations considering
people. separate aspects of the installation. In the latter case
however, greater co-ordination will be required by the
duty holder to ensure that all parts of the scheme have
4.3 PERFORMANCE STANDARDS been adequately addressed and that interfaces are
effectively managed. Although not mandatory, it is
A Performance Standard is a qualitative or quantitative generally recommended that where multiple ICPs are
statement of the performance required of a system or employed, one has an overseeing role.
item of equipment in order for it to satisfactorily fulfil

This document is issued with a single user licence to the EI registered subscriber: goke.akintola@petrofac.com
IMPORTANT: This document is subject to a licence agreement issued by the Energy Institute, London, UK. It may only be used in accordance with
the licence terms and conditions. It must not be forwarded to, or stored, or accessed by, any unauthorised user. Enquiries: e:pubs@energyinst.org t:
+44 (0)207 467 7100
GUIDELINES FOR THE MANAGEMENT OF SAFETY CRITICAL ELEMENTS

This document is issued with a single user licence to the EI registered subscriber: goke.akintola@petrofac.com
IMPORTANT: This document is subject to a licence agreement issued by the Energy Institute, London, UK. It may only be used in accordance with
the licence terms and conditions. It must not be forwarded to, or stored, or accessed by, any unauthorised user. Enquiries: e:pubs@energyinst.org t:
+44 (0)207 467 7100
5

IDENTIFICATION OF SCEs

Although there are various different, and equally which are common to all. These common steps are
acceptable, ways of identifying SCEs there are steps shown in Figure 5.1 and described below.

Identify Major Accident


events using the
Safety Case

Identify structure and plant which can cause, prevent,


detect, control, mitigate, rescue or help recover from a
major accident

Identify PFEER specified plant

Record items identified


as SCEs

Figure 5.1: Identification of SCEs

This document is issued with a single user licence to the EI registered subscriber: goke.akintola@petrofac.com
IMPORTANT: This document is subject to a licence agreement issued by the Energy Institute, London, UK. It may only be used in accordance with
the licence terms and conditions. It must not be forwarded to, or stored, or accessed by, any unauthorised user. Enquiries: e:pubs@energyinst.org t:
+44 (0)207 467 7100
GUIDELINES FOR THE MANAGEMENT OF SAFETY CRITICAL ELEMENTS

Step 1: Identify the major accident events on the The outcome of these deliberations should be
installation recorded giving the reasons why an item has, or has not
been identified as safety critical and with reference to
This is carried out using a series of hazard identification the relevant major accident hazard.
techniques, involving both qualitative and quantitative
methods. The results from this process are generally Step 3: Identify PFEER Specified Plant
recorded in a Hazard Register which documents all of
the potential major accident event scenarios on an Specified Plant is any of the plant of an installation
installation, and should be documented in the safety which is provided:
case for the installation.
— To comply with Regulations 11(1)(a), 13, 15 and
Step 2: Identification of structures and plant which 16 of the PFEER Regulations.
can cause, contribute to, prevent or help
recover from a major accident — As a means of detecting fire and for detecting and
recording accumulations of flammable gases (as
Duty holders will generally utilise lists of plant and required by Regulation 10 of the PFEER
equipment, extracted from their computerised Regulations).
maintenance management systems, as the starting point
for assessing which of the items on the list are safety — Measures to combat fire and explosion as required
critical. The issue of 'how deep to dig' is one that by Regulation 12 of the PFEER Regulations.
requires to be addressed before the identification
process can begin. Approaches vary, but SCEs need to Step 4: Prepare a record of items identified as
be defined at an appropriate level such that they have a Safety Critical Elements
direct linkage to MAHs, and it is also clear whether or
not an equipment item forms part of one or more SCEs. It is important that the record of SCEs is maintained up
A team approach to SCE selection is usual as it is to date, therefore the major accident analyses and the
unlikely that a single person would have sufficient list of SCEs should be reviewed periodically. The list
technical appreciation of the major accident analyses should also be reviewed prior to the addition of new
and detailed knowledge of the installation. Starting from equipment or modification of existing plant.
the complete list of equipment the team should assess A typical (but non-exhaustive) example, showing
each item in turn and form a view as to whether it could the interrelationship between MAHs and SCEs is given
cause, contribute to, prevent or help recover from, a below.
major accident.

10

This document is issued with a single user licence to the EI registered subscriber: goke.akintola@petrofac.com
IMPORTANT: This document is subject to a licence agreement issued by the Energy Institute, London, UK. It may only be used in accordance with
the licence terms and conditions. It must not be forwarded to, or stored, or accessed by, any unauthorised user. Enquiries: e:pubs@energyinst.org t:
+44 (0)207 467 7100
IDENTIFICATION OF SCEs

HAZARD PRIMARY SAFETY CRITICAL ELEMENTS AND SUB-ELEMENTS


IDENTIFICATION MAJOR
PRESSURE VESSELS
AND ASSESSMENT HAZARDS
PROCESS PIPING
CONTAINMENT PIPELINES
WELLS
FIRE

IGNITION Ex CERTIFIED EQUIP.


CONTROL ELECTRICAL TRIPPING EQUIP.
EARTHING AND BONDING EQUIP.

MAINTENANCE MANAGEMENT SYSTEM


EXPLOSION SAFEGUARDING
PROCESS SHUTDOWN SYSTEM
SYSTEMS
EMERGENCY SHUTDOWN SYSTEM
MAJOR FIRE AND GAS SYSTEM
ACCIDENT FIRE
SCENARIOS HELICOPTER PROTECTION WATER FIRE FIGHTING
CRASH CHEMICAL FIRE FIGHTING
PASSIVE FIRE PROTECTION
NAVIGATIONAL
AIDS AIRCRAFT
MAJOR SEACRAFT
SHIP
ACCIDENT
COLLISION
HAZARDS SUPPORT STRUCTURES
STRUCTURES FACILITY STRUCTURES
EXPLOSION PROTECTION

STRUCTURAL LIFTING CRANES


MAJOR FAILURE EQUIPMENT LIFTING GEAR AND BEAMS
HAZARDS
REGISTER
TURBINE P.M. FOR COMPRESSORS
ROTATING TURBINE P.M. FOR GENERATORS
DROPPED EQUIPMENT
OBJECTS RADIOS
TELEPHONES
COMMUNICATIONS PUBLIC ADDRESS
EQUIPMENT
TURBINE
LIFEBOATS
DISC
ESCAPE, LIFERAFTS
FAILURE
EVACUATION AND HELICOPTER RESCUE BOX
FLOW RESCUE EQUIPMENT PERSONAL SAFETY EQUIPMENT

11

This document is issued with a single user licence to the EI registered subscriber: goke.akintola@petrofac.com
IMPORTANT: This document is subject to a licence agreement issued by the Energy Institute, London, UK. It may only be used in accordance with
the licence terms and conditions. It must not be forwarded to, or stored, or accessed by, any unauthorised user. Enquiries: e:pubs@energyinst.org t:
+44 (0)207 467 7100
GUIDELINES FOR THE MANAGEMENT OF SAFETY CRITICAL ELEMENTS

12

This document is issued with a single user licence to the EI registered subscriber: goke.akintola@petrofac.com
IMPORTANT: This document is subject to a licence agreement issued by the Energy Institute, London, UK. It may only be used in accordance with
the licence terms and conditions. It must not be forwarded to, or stored, or accessed by, any unauthorised user. Enquiries: e:pubs@energyinst.org t:
+44 (0)207 467 7100
6

DEVELOPMENT OF PERFORMANCE
STANDARDS
This activity follows from the identification of MAHs — Functionality – What is it required to do?
and selection of SCEs described in Section 5. — Availability – For what proportion of time will it be
The creation of Performance Standards (PSs) is the capable of performing?
process by which a duty holder sets out what is — Reliability – How likely is it to perform on
expected of an SCE. The PSs are the criteria against demand?
which the initial and ongoing suitability of an SCE is — Survivability – Does it have a role to perform post
assessed. Safety Integrity Level (SIL) assessments may event?
be used to develop PSs for instrument based protective — Interactions – Do other systems require to be
systems. functional for it to operate?
Performance Standards for SCEs are generally
defined in terms of:

13

This document is issued with a single user licence to the EI registered subscriber: goke.akintola@petrofac.com
IMPORTANT: This document is subject to a licence agreement issued by the Energy Institute, London, UK. It may only be used in accordance with
the licence terms and conditions. It must not be forwarded to, or stored, or accessed by, any unauthorised user. Enquiries: e:pubs@energyinst.org t:
+44 (0)207 467 7100
GUIDELINES FOR THE MANAGEMENT OF SAFETY CRITICAL ELEMENTS

14

This document is issued with a single user licence to the EI registered subscriber: goke.akintola@petrofac.com
IMPORTANT: This document is subject to a licence agreement issued by the Energy Institute, London, UK. It may only be used in accordance with
the licence terms and conditions. It must not be forwarded to, or stored, or accessed by, any unauthorised user. Enquiries: e:pubs@energyinst.org t:
+44 (0)207 467 7100
7

ASSURANCE OF SCE INTEGRITY

It is the responsibility of the duty holder to ensure that 2. Ensuring that assurance activities are carried out at
SCEs are able to perform their intended functions with the appropriate time by competent people.
the required availability and reliability throughout their
service. 3. Maintaining a record of these activities and any
findings that arise.
This should be achieved by the following means:
4. Addressing any deficiencies arising from assurance
1. Identifying those assurance activities, such as activities as soon as possible and taking any
maintenance, inspection and testing, that are temporary measures that may be necessary to
required to maintain the SCE in a suitable maintain risk ALARP until deficiencies have been
condition. rectified. Any temporary measures should be
subject to review and comment by the ICP.

15

This document is issued with a single user licence to the EI registered subscriber: goke.akintola@petrofac.com
IMPORTANT: This document is subject to a licence agreement issued by the Energy Institute, London, UK. It may only be used in accordance with
the licence terms and conditions. It must not be forwarded to, or stored, or accessed by, any unauthorised user. Enquiries: e:pubs@energyinst.org t:
+44 (0)207 467 7100
GUIDELINES FOR THE MANAGEMENT OF SAFETY CRITICAL ELEMENTS

16

This document is issued with a single user licence to the EI registered subscriber: goke.akintola@petrofac.com
IMPORTANT: This document is subject to a licence agreement issued by the Energy Institute, London, UK. It may only be used in accordance with
the licence terms and conditions. It must not be forwarded to, or stored, or accessed by, any unauthorised user. Enquiries: e:pubs@energyinst.org t:
+44 (0)207 467 7100
8

VERIFICATION THROUGHOUT THE


ASSET LIFE
8.1 OVERVIEW OF VERIFICATION 8.1.2 Responsibilities of the ICP

This section provides an overview of verification and The ICP is required to review and comment on the list
description of how verification should be approached of SCEs and ensure himself that Performance Standards
during the various stages of the asset’s life. are appropriate; any reservation raised by the ICP
should be recorded.
8.1.1 Elements of a verification scheme The verification scheme may be drawn up by either
the duty holder (or an appointee acting on its behalf), or
A verification scheme must address the following (see the duty holder in conjunction with the ICP. If it is not
OSCR (2005) Schedule 7): drawn up by the ICP, then the ICP must review and
comment on the scheme and a record of that review
1. The principles to be used in selecting persons to (including any comments or reservations as a result of
perform functions under the scheme and keep it unresolved issues arising) should be retained as part of
under review (i.e. the ICP). the scheme records.
The ICP is responsible for carrying out the
2. Arrangements for communicating necessary verification activities detailed in the verification
information to persons performing functions under scheme. The duty holder is responsible for ensuring that
the scheme and reviewing it. the ICP is provided with all access necessary and
information required to carry out the verification
3. The nature and frequency of examination and activities.
testing.
8.1.3 Verification activities
4. Arrangements for reviewing and revising the
scheme. Verification activities are those carried out by the ICP
and are intended to either directly establish the
5. Arrangements for record keeping for examinations suitability of the SCE, or to establish that appropriate
and tests carried out, results and findings, assurance activities have been undertaken (e.g. the
recommended actions and close-out of witnessing of emergency shutdown system function
recommended actions. tests).
Both assurance and verification activities should be
6. Arrangements for communicating 5. to the defined in the same written scheme of examination, but
appropriate level in the duty holder’s organisation. only an ICP can carry out verification activities.

17

This document is issued with a single user licence to the EI registered subscriber: goke.akintola@petrofac.com
IMPORTANT: This document is subject to a licence agreement issued by the Energy Institute, London, UK. It may only be used in accordance with
the licence terms and conditions. It must not be forwarded to, or stored, or accessed by, any unauthorised user. Enquiries: e:pubs@energyinst.org t:
+44 (0)207 467 7100
GUIDELINES FOR THE MANAGEMENT OF SAFETY CRITICAL ELEMENTS

The verification scheme should provide a clear 8.2.2 Performance Standards for SCEs
indication of the nature and frequency of the verification
activity that the ICP is expected to carry out. Once SCEs have been identified, Performance
When assurance and maintenance work is carried Standards (PSs) need to be set for each (see Section 6).
out sufficient information should be recorded to show Those PSs associated with establishing “initial
that the SCE remains in good repair and condition. This suitability” may be different to those used to assess
is particularly important where availability and ongoing suitability throughout the operational life of the
reliability performance standards require to be SCE. There are a number of ways of dealing with this
demonstrable. issue including the development of separate PSs for
initial and ongoing assessment and the incorporation of
both into a single PS. Regardless of the approach taken,
8.2 VERIFICATION IN THE CONCEPT, FEED, it is essential that the requirement contained in the PS
DESIGN, CONSTRUCTION AND assures that the SCE can fulfil its function. The PS must
COMMISSIONING PHASES also be written in such a way that it can be clearly
established whether or not the required standard of
During these initial phases of a development project, the performance has been achieved.
duty holder is required to demonstrate “initial
suitability” of SCEs through the following: 8.2.3 Documenting the scheme

— Consideration of the design. There is no fixed way of documenting a new


— Confirmation of the adequacy of manufacture, construction verification scheme and a number of
fabrication and installation. methods have been employed ranging from having all
— Demonstration during commissioning that the details and records in a single document to having a
SCEs are capable of meeting the required number of separate documents dealing with different
performance standards. requirements. In the later case, an overall document will
be necessary in order to describe how the various pieces
The ICP’s role is to carry out independent examination of documentation relate to each other. Whichever
of documents, activities and plant and equipment to approach is taken, it should ensure that all the details
confirm the level of compliance with the performance required by Schedule 7 of OSCR are provided (see
standards. section 8.1).
The identification of SCEs and the setting of
performance standards are important activities during 8.2.4 Execution
these pre-operating stages of the project as they provide
the foundation for managing the MAH risk. During the design and construction phase the following
Development of a verification scheme for new issues need to be considered in executing the
construction requires input and co-ordination from a verification scheme:
number of different parties within the duty holder’s
organisation, and also from the ICP, design contractors, — Identification of design deliverables for
fabricators and completions team. The early verification.
engagement of all parties in the process is crucial to a — Timing of verification submissions for design.
successful outcome. Particular effort should be made to — Scope of procurement/fabrication verification
ensure that previous operational experience is utilised activities.
during the detailed design and construction phases. — Scope of verification activities during Hook up
Installation and Commissioning (HUIC).
8.2.1 Major Accident Hazards and SCEs — Verification during start-up activities.
— Close-out of Construction (Project) Verification
It is usual to produce a document (MAH / SCE matrix) Scope.
listing the SCEs and describing their derivation linkage
to the MAH (See section 5). Where changes to process
plant and equipment are undertaken, a similar document (i) Identification of design deliverables for
should be produced identifying the impact on the verification
existing SCEs of each modification and identifying any It is important that the design deliverables that are
new SCEs resulting from the changes to MAHs (see subject to review by the ICP are clearly defined and
Section 9.1). agreed as early as possible in the life of the project. This

18

This document is issued with a single user licence to the EI registered subscriber: goke.akintola@petrofac.com
IMPORTANT: This document is subject to a licence agreement issued by the Energy Institute, London, UK. It may only be used in accordance with
the licence terms and conditions. It must not be forwarded to, or stored, or accessed by, any unauthorised user. Enquiries: e:pubs@energyinst.org t:
+44 (0)207 467 7100
VERIFICATION THROUGHOUT THE ASSET LIFE

process is usually facilitated by a mark-up of the project activities should again, be related to the risk of failure of
Master Document Register (MDR). the SCE to perform and should be agreed between the
Sufficient records should be maintained by the ICP ICP and duty tolder.
to ensure that the documentation subject to review for Verification activities during commissioning should
each SCE is clearly identified and that its status, be supported by the issue of specific instructions to ICP
together with any associated ICP comment, can be surveyors.
readily established at any time during the process. The
duty holder may elect to maintain these records himself. (v) Verification during start-up activities
A clear system should be established by the project The project should produce a specific start-up plan for
to alert the ICP to changes to design documentation bringing the new or modified facilities into use. The
already examined which could affect the determination purpose of this is to allow the duty holder to manage the
of suitability. This will help to avoid any necessity for changing MAH and risk profile during this phase of the
examination of successive revisions of documentation project. This should be reviewed by the ICP and
in the future. The system should be subject to ICP audit agreement reached with the duty holder with regard to
and included as part of the overall verification scheme. a schedule for finally establishing suitability for each
SCE. Dependent on the situation, some SCEs will
(ii) Timing of verification submissions for design require to be fully functional (and verified) sooner than
Where possible, design documentation should be others and equally, “Partial” SCEs are likely to be
divided into logical packages per SCE in consultation required at some stages.
with the ICP and a schedule for submission/examination A formal documented process should be established
established. This will allow the most effective use of which allows the duty holder to assess the status of
resources on behalf of the ICP and enable the progress assurance and verification at each stage of the start-up
of the scheme, with regard to the different SCEs, to be process.
easily established.
It is particularly important that the ICP be given the (vi) Close-out of Construction (Project) Verification
opportunity to review and comment on the design early Scope
enough to be in a position to influence any changes At the end of the project, and as part of the handover to
necessary to ensure suitability. operations, the conclusions of the project verification
scheme should be documented and agreed.
(iii) Scope of procurement/fabrication verification These will include:
activities
As early as possible within the FEED and detailed — The results of the ICP scrutiny of the list of SCEs
design stages, a procurement register should be made and the verification scheme itself.
available to the ICP and agreement reached as to those — A completed matrix relating examinations
items which are to be subject to verification at source undertaken to particular SCEs.
(i.e. at a vendor’s works). — Completed and signed off ICP work instructions
The extent of verification activities proposed will issued at each stage.
be agreed between the ICP and duty holder and should — A statement of any conditions or reservations
relate to the risk associated with failure of each of the expressed by the ICP during the course of the
item(s) concerned. examinations.
Verification activities at vendors’ works or at major — A final statement as to the suitability of the
fabrication sites, should be documented by the issue of identified SCEs.
specific instructions to ICP surveyors complemented by
a mark-up of the vendor/fabricator’s planned inspection
and test schedules to indicate those points where 8.3 IN-SERVICE VERIFICATION
intervention is required.
Verification of the ongoing suitability of SCEs on
(iv) Scope of verification activities during HUIC offshore installations begins once they are in operation.
Prior to commencement of commissioning activities An in-service verification scheme should be prepared
(either onshore or offshore) the commissioning plans for during the construction phase and all interested parties
SCE systems should be made available for ICP review, made familiar with it before the installation is taken into
comment and mark-up, to indicate those activities operation. Those interested parties include:
subject to verification review and the extent of ICP
involvement. The nature and frequency of these — Duty holder’s verification engineer/coordinator.

19

This document is issued with a single user licence to the EI registered subscriber: goke.akintola@petrofac.com
IMPORTANT: This document is subject to a licence agreement issued by the Energy Institute, London, UK. It may only be used in accordance with
the licence terms and conditions. It must not be forwarded to, or stored, or accessed by, any unauthorised user. Enquiries: e:pubs@energyinst.org t:
+44 (0)207 467 7100
GUIDELINES FOR THE MANAGEMENT OF SAFETY CRITICAL ELEMENTS

— Technical Authorities within the duty holder and 8.3.4 ICP Recommendations
engineering support organisations.
— Representatives from the duty holder’s Safety In instances where a compromised SCE is identified or
Engineering department. where a PS is inadequately addressed during the
— Relevant ICPs. verification process, the ICP report should contain a
clear statement regarding 'continuing suitability' and a
8.3.1 Units entering the UKCS recommendation as to the course of action which should
be adopted by the duty holder.
In the case of an existing installation being taken into The verification scheme should contain targets for
use on the UKCS for the first time, a safety case should initial response times and final close-out times for ICP
be developed and an associated verification scheme recommendations.
should be set in place in preparation for the beginning It is the duty holder’s responsibility to address any
of the operating period. It will be necessary for such a recommendation made by the ICP in order to restore the
scheme to address the 'initial' as well as the 'ongoing' affected SCE to the capability stipulated by the PS, in
suitability of the identified SCEs. the most expedient manner.

8.3.2 Scheme revision


8.4 DECOMMISSIONING
Verification schemes should be kept under continuous
review and revised as often as is necessary to keep them 8.4.1 Review of MAHs.
up to date. In addition to periodic reviews a scheme
review should be initiated by changes such as the At least three months prior to decommissioning taking
following: place, the duty holder should prepare revisions to the
installation safety case and these should be assessed for
— Revision of any Codes or Standards referenced in any impact on the list of SCEs. These changes would
the scheme. result from:
— Modifications to the installation which result in
amendments to the list of SCEs. — A hydrocarbon free environment.
— Significant revision to the installation Safety Case. — Hazard identification primarily focussed on heavy
— Changes to installation operating parameters. construction, lifting and marine operations.
— Changes to environmental conditions. — Residual hazards after the decommissioning:
- navigational/marine traffic;
8.3.3 Reporting - environmental/pollution;
- seabed/fishing gear.
Reports of verification surveys undertaken by ICPs
either onshore or offshore should be presented to the The amended SCE list will be significantly different
duty holder’s nominated representative in a timely from the operational case and PSs should be revised or
manner. Each report should provide the duty holder rewritten and a decommissioning verification scheme
with a clear representation of the condition of the SCE produced that will confirm ongoing suitability of SCEs
and confirmation or otherwise, that the PS has been during key stages of the decommissioning.
fully addressed. It is not sufficient to report 'by
exception' as this does not present a full picture of the
condition of the SCEs.

20

This document is issued with a single user licence to the EI registered subscriber: goke.akintola@petrofac.com
IMPORTANT: This document is subject to a licence agreement issued by the Energy Institute, London, UK. It may only be used in accordance with
the licence terms and conditions. It must not be forwarded to, or stored, or accessed by, any unauthorised user. Enquiries: e:pubs@energyinst.org t:
+44 (0)207 467 7100
9

CHANGE MANAGEMENT

9.1 MODIFICATIONS — Identification of new SCEs.


— Reassessment of existing Performance Standards
9.1.1 Importance of duty holders’ Management and the need for new Performance Standards for
of Change systems new SCEs.
— Need to clearly document project verification
Duty holders should have a documented and effective activities for "initial suitability".
process for the management of change and — Incorporation of changes and modifications into
modifications to platform systems, components or ongoing operational verification (and maintenance)
structures. Responsibility and/or accountability of regimes with any proposed revisions to SCE
individuals within the duty holder’s organisation for the maintenance regimes being reviewed by the ICP.
various functions within the change process should be — Involvement of operations and the "Operational"
clearly defined. Changes directly affecting SCEs or ICP in project scope.
impacting on SCE functions in managing risk should
provide for update of any formal risk assessments where
appropriate. The process should make explicit reference 9.2 TEMPORARY EQUIPMENT
to the involvement of the ICP in all modifications which
impact upon existing SCEs or the creatation of new 9.2.1 Temporary equipment impact on SCEs
ones. The 'management of change' document should be
controlled by the duty holder and referenced in the duty Duty holders should have a documented process in
holder’s verification scheme. place to demonstrate their intention and ability to
manage the transportation and use of temporary
9.1.2 Need for SCE Impact study equipment and in particular, equipment which adds to or
impacts upon the list of SCEs. This process should be
During the assessment of individual modifications, it is referenced in the Verification Scheme for each
important to have a thorough understanding of the installation.
original MAH identification and the philosophies for
prevention, mitigation and control. All modifications 9.2.2 Performance Standards for temporary
should be assessed to establish their impact on the equipment
existing list of SCEs or if they create additional SCEs.
For those modifications which are confirmed to have Performance Standards should be established for items
safety critical content, the following aspects need to be of temporary equipment in all cases where the existing
considered: PS applicable to the installation is either inadequate or
inappropriate.

21

This document is issued with a single user licence to the EI registered subscriber: goke.akintola@petrofac.com
IMPORTANT: This document is subject to a licence agreement issued by the Energy Institute, London, UK. It may only be used in accordance with
the licence terms and conditions. It must not be forwarded to, or stored, or accessed by, any unauthorised user. Enquiries: e:pubs@energyinst.org t:
+44 (0)207 467 7100
GUIDELINES FOR THE MANAGEMENT OF SAFETY CRITICAL ELEMENTS

9.2.3 Assurance and verification activities for The installation verification scheme should identify the
temporary equipment nature and frequency of assurance and verification
activities associated with temporary equipment; these
Temporary or portable equipment for use on an offshore should include:
installation should be subject to appropriate assurance
and verification activities if: — Examination of equipment prior to shipment.
— Witnessing of testing prior to shipment.
— The equipment in itself creates an addition to the — Review of manufacturers’ / suppliers’ records /
platform list of SCEs (e.g. demountable drilling certification.
equipment not permanently held on the — Examination of equipment offshore.
installation). — Auditing of the management processes and records
— The equipment impacts on any of the existing held:
platform SCEs: - by the duty holder onshore and offshore;
- by virtue of the planned location on the - by the Shipping/Forwarding contractor.
installation (e.g. engine driven generator/
compressor required to operate in a designated Comprehensive records should be maintained by the
hazardous area); duty holder to confirm adherence to the process. These
- by virtue of the proposed application (e.g. well records should be available to the ICP.
intervention equipment once it becomes part of
the reservoir pressure envelope).

22

This document is issued with a single user licence to the EI registered subscriber: goke.akintola@petrofac.com
IMPORTANT: This document is subject to a licence agreement issued by the Energy Institute, London, UK. It may only be used in accordance with
the licence terms and conditions. It must not be forwarded to, or stored, or accessed by, any unauthorised user. Enquiries: e:pubs@energyinst.org t:
+44 (0)207 467 7100
10

REFERENCES AND
GLOSSARY OF TERMS

10.1 REFERENCES OF FURTHER 10.2 GLOSSARY OF TERMS


INFORMATION

List of references and further information sources from FEED Front End Engineering Design
HSE, UKOOA and EI: HUIC Hook Up, Installation and Commissioning
ICPs Independent Competent Persons
— A Guide to the Offshore Installations (Safety Case) MAHs Major Accident Hazards
Regulations 2005 (HSE, 2006) MDR Master Document Register
OSCR Offshore Safety Case Regulations
— Prevention of Fire and Explosion and Emergency PFEER Prevention of Fire and Explosion and
Response on Offshore Installations – Approved Emergency Response Regulations
Code of Practice and Guidance (HSE, 1997) PSs Performance Standards
SCEs Safety Critical Elements
— Asset Integrity Toolkit (UKOOA, 2006) UKOOA UK Offshore Operators Association

23

This document is issued with a single user licence to the EI registered subscriber: goke.akintola@petrofac.com
IMPORTANT: This document is subject to a licence agreement issued by the Energy Institute, London, UK. It may only be used in accordance with
the licence terms and conditions. It must not be forwarded to, or stored, or accessed by, any unauthorised user. Enquiries: e:pubs@energyinst.org t:
+44 (0)207 467 7100
GUIDELINES FOR THE MANAGEMENT OF SAFETY CRITICAL ELEMENTS

24

This document is issued with a single user licence to the EI registered subscriber: goke.akintola@petrofac.com
IMPORTANT: This document is subject to a licence agreement issued by the Energy Institute, London, UK. It may only be used in accordance with
the licence terms and conditions. It must not be forwarded to, or stored, or accessed by, any unauthorised user. Enquiries: e:pubs@energyinst.org t:
+44 (0)207 467 7100
Energy Institute This publication has been produced as a result of
61 New Cavendish Street work carried out within the Technical Team of the
London W1G 7AR, UK Energy Institute (EI), funded by the EI’s Technical
Partners. The EI’s Technical Work Programme
t: +44 (0) 20 7467 7157 provides industry with cost effective, value adding
f: +44 (0) 20 7255 1472 knowledge on key current and future issues
e: pubs@energyinst.org.uk affecting those operating in the energy sector,
www.energyinst.org.uk both in the UK and beyond.

ISBN 978 0 85293 462 3

Registered Charity Number 1097899

This document is issued with a single user licence to the EI registered subscriber: goke.akintola@petrofac.com
IMPORTANT: This document is subject to a licence agreement issued by the Energy Institute, London, UK. It may only be used in accordance with
the licence terms and conditions. It must not be forwarded to, or stored, or accessed by, any unauthorised user. Enquiries: e:pubs@energyinst.org t:
+44 (0)207 467 7100