Global Marine and Energy Practice

Loss Control NewsletterIssue 1 – 2008

January 2008 | 31st year of publication

Please direct correspondence to:

The EditorLoss Control Newsletter

Tower PlaceLondon

EC3R 5BU

Email: LCNeditor@mmc.com

Issue 1, 2008 – Editorial

In this issue

Product profile: Onshore third party liability review ...... 2

Safety news from around the world ............................ 4

Lessons from the past: Are we learning, can we learn? ................................... 6

Hydrogen gas detection in battery rooms ................. 11

Process safety performance indicators: The end of the beginning .......................................... 13

Typical fired heater problems and root causes ........... 15

BP Fire Safety Series | Reviewed ................................. 18

Fire and gas detection mapping ................................. 20

Loss report 2007 ....................................................... 24

Chemical ...................................................................... 24

Distribution .................................................................. 25

E&P Offshore ............................................................... 28

E&P Onshore ................................................................ 31

Fertiliser ....................................................................... 32

Gas Processing ............................................................. 32

Oil Sands Facility .......................................................... 33

Refinery ....................................................................... 33

Marsh’s Marine and Energy training courses 2008 ..... 38

Safety news from around the worldProcess safety management (PSM) is an issue that is gaining even more momentum, particularly in light of the recommendations from the Baker Report. In this edition we are able to offer some useful sources of information for the determination of metrics for effective PSM. This includes the newly published Center for Chemical Process Safety (CCPS) guideline as well as more established guidance from the Health and Safety Executive (HSE) and Organisation for Economic Co-operation and Development (OECD). This also complements one of our own articles in this edition relating to PSM.

We also have some news on attempts to begin a Chinese cultural revolution of a different kind. Chinese authorities are now taking measures to improve safety and environmental performance across the country.

In the UK, the HSE have also expressed concerns about safety in offshore oil rigs and have produced an interesting report incorporating more than three years of extensive data collection.

Lessons from the past: Are we learning, can we learn?So often, when reviewing incidents that occur we see the same causes and errors that have caused similar incidents on many occasions elsewhere. So whilst we often like to think that we learn from our own mistakes, it is quite clear that we are not learning from those made by others. Iain Clough investigates possible reasons for this as he summarises a paper he presented in the Inistitute of Chemical Engineer’s Loss Prevention Symposium in 2007.

Hydrogen gas detection in battery roomsWe are all aware that the charging of some batteries results in the evolution of hydrogen gas. But what are the risks of such activities resulting in flammable concentrations of hydrogen, for instance, in battery rooms that provide emergency power for process plants? This short article written by John Munnings-Tomes gives some insight into best practice and provides some suggested guidance we hope is of use to our readers.

Process safety performance indicators: The end of the beginningThe process industry has been regularly reporting personal accident statistics, but it has been known for a long time now that such statistics are no real indicator as to the effectiveness of an organisation’s management of process hazards. So will process safety performance indicators, such as those recommended in the newly issued CCPS document (above), be the solution for all of our problems? Jonathan Connors discusses.

Typical fired heater problems and root causesFired heaters are well understood and designed pieces of plant used throughout the processing industry, but are so often problematic. This brief item provides some guidance to help you to identify the possible root causes of your heater problems and improve your overall reliability and safety.

1

Product profile: Onshore third party liability reviewOverviewFor a business to be viable in the long term, companies need to be protected against possible loss scenarios, which can include significant exposure to liability claims following an unfortunate incident such as an explosion, fire, toxic release or environmental damage. This is especially true in societies that have a litigious attitude. Another area to be considered is the cost of cleaning up after an environmental incident.

In many cases, potential third party liability exposures can far outweigh other exposures that have been given more attention historically. By having a clear liability exposure analysis, a control strategy can be implemented that will ensure that the company assets, image and surrounding community are adequately protected.

Our experience shows that companies that have not carried out an extensive review of the effects of possible on-or-offsite incidents, and their implications for third parties, may find that exposures are higher than initially expected.

On the basis of a relatively short and inexpensive survey, an assessment can be supplied that will assist in:

identifying key third party liability issues;

quantifying the effects of potential scenarios (where possible);

making decisions on risk retention or balance-sheet protection available from external sources, e.g. the insurance markets;

identifying key areas for improvement; and

prioritising improvement measures against available resources for effective risk management.

In combination with estimated maximum losses for other insurance classes, e.g. property damage, business interruption and/or cost of control, overall exposure of the company to loss scenarios can be evaluated. This can aid in evaluating maximum aggregate loss potential for an individual site or group portfolio.

Book review: BP Fire Safety Series, LNG Fire Protection and Emergency ResponseTom Anthoni critiques one of the latest publications in BP’s fire safety series, intended to provide guidance on LNG, its properties, safe handling and storage, and how to prevent and respond to hazardous scenarios.

Fire and gas detection mapping - Computer aided design to increase safety and reduce costOur guest author in this edition is Kevin Keefe of Micropack. He provides a fascinating insight into how modern techniques can help to ensure that the design and arrangement of fire and gas detectors are optimised and, potentially, be used as an integral part of a facility’s safety studies.

Loss reportThe loss report includes a selection of losses from the energy industry for the latter half of 2007. As well as the usual, all-too-familiar types of losses, the second half of 2007 also saw an unusually high number of significant incidents occurring offshore; one particularly tragic incident being the deadliest in the Gulf of Mexico for more than 40 years.

Marsh Marine and Energy training courses 2008A summary of the courses available to increase your knowledge of marine and energy insurance and risk management.

Marsh newsMarsh’s National Oil Companies (NOC) Conference is the landmark industry event specifically devoted to NOCs and addresses the risk issues and challenges they face. The 2008 event will be held at the Madinat Jumeirah in Dubai, February 25-27, 2008.

Continuing the dialogue started in 2007 amongst NOCs, the 2008 conference will provide a forum for you to discuss ideas and experiences with your peers, look at vital industry issues such as operational, financial and strategic risk in NOC operations as well as opportunities to unlock the “upside” of risk to the benefit of your organisations.

To find out more, register for the conference and make hotel reservations at our special rates, please visit: http://programs.regweb.com/marsh/2008NOC

2

Product profile

Product profile: Onshore third party liability reviewObjectives and benefitsThe objectives of the study are to:

identify key third party liability exposures for each site involved in the study with respect to physical damage, impact on personnel and impact on the environment; and

following collection of relevant information:

– quantify impact on third party property (or qualitative estimate if values are not available)

– rank potential human effects– rank potential environmental exposures.

Benefits of carrying out a review of this type include:

access to Marsh insurance-related experience and expertise in evaluating third party liability exposures;

third party liability exposures identified in the review can be combined with other exposures that may have been previously analysed e.g. property damage, business interruption and/or cost of control estimated maximum losses. This enables evaluation of the maximum aggregate loss for a site or group portfolio;

the results of the study will allow better-informed decisions regarding risk management strategy;

by identifying the larger exposures, key areas for improvement will be highlighted;

in some cases, loss scenarios may not have been previously identified, thus increasing management awareness of potential issues that could have significant adverse effects on company profitability; and

study costs will be minimised for existing clients, where information gained through previous visits can be used to minimise the length of the study.

Approach and scopeThe reviews typically include an analysis of potential scenarios, which may include one or more of the following:

vapour cloud explosions;

BLEVE’s (Boiling Liquid Expanding Vapour Explosions);

vessel disintegration;

flash fires;

toxic releases; and

oil spills.

Evaluation of these scenarios is based on the latest Marsh loss prevention techniques and databases not commonly available in published standards, supported by information available in the public domain.

It should be noted that the largest property loss might not necessarily coincide with the largest liability loss. Scenarios will usually be graded in terms of quantified physical damage, impact on third party property, impact on personnel and impact on the environment.

Deliverables and working arrangementsMarsh can call upon one of its 12 experienced chemical engineers to conduct the third party liability review, which will include:

a visit to the site(s); and

in some cases, where sites have previously been visited, it may be possible to conduct a desk-top review, following the supply of any additional information that is required.

The review results in a comprehensive report being produced in English. This will usually include estimates of the impact on property, personnel and the environment for the maximum physical damage case, as well as other potentially larger exposure impacts. Reports can be tailored to meet specific client objectives.

3

Product profile

Safety news from around the world

China – report on worker accidentsOn 23 December 2007, the Chinese State Administration of Work Safety (SAWS) stated that there had been a 22.4% drop in the number of accidents reported for the period of January to November 2007 compared to the previous year. The total number of accidents reported across all industries was approximately 457,000, with a total number of accidental work-related deaths at 88,923 for the same period – representing a decrease of around 14% on the previous year.

There has been an unprecedented expansion of industries within the region in recent years and unfortunately the accident frequencies, in particular fatal accidents, has also been extremely high. Some measures have been taken, such as the enactment of the Work Safety Law in 2002, which has resulted in the generation of provincial legislative committees and more than 50 administrative State Council regulations covering various aspects of workplace safety today. The Communist Party of China’s disciplinary watchdog also released a 10-point document in December imposing stricter penalties on those failing to maintain safety in workplaces. Looking forward to 2008, the emergency regulations on work safety are expected to be drafted.

China – pollution surveyFebruary 2008 sees the first ever national pollution census to be conducted in China. There will be a nationwide survey to identify all sources of pollution, in particular industrial pollution, and to assess the number of pollution treatment facilities in operation. The data will be collected over a two-month period and then reviewed, a process that is expected to be completed in the first half of 2008. The data will then be analysed, followed by examination and approval in the first half of 2009. China’s State Council decided to carry out the survey in October 2006 in response to concerns over the extent of pollution in China and the perceived lack of trustworthy statistics on the sources and extent of the pollution.

The main intention is reportedly to gather sufficient data for China to draw up a baseline for future environmental protection measures and not linked to any penalties for poor performance by local administrations.

U.S. – Center for Chemical Process Safety issues guidance on process safety performance indicatorsThe end of 2007 saw the Center for Chemical Process Safety (CCPS) issue their guidance on process safety performance indicators (PSPI) entitled “Process Safety Leading and Lagging Metrics...You don’t improve what you don’t measure”.

The document is a culmination of a project that was first authorised by the CCPS Technical Steering Committee in 2006 to help industry monitor progress and drive improvement in process safety programmes. The team responsible for its development was comprised of a large number of CCPS member companies and external

stakeholders. The ultimate intention of including so many representatives from industry was to develop an industry lagging metric that would become the benchmark across the chemical and petroleum industry for measuring process safety performance. The guidance document itself proposes a concise set of metrics for companies to adopt when setting PSPIs.

The guidance can be downloaded electronically free of, charge from the CCPS website: www.aiche.org/ccps/metrics/index.aspx

The website also includes an additional toolkit developed by The Dow Chemical Company for the evaluation of process safety incidents.

4

This is not the first set of guidance for companies, with the Organisation for Economic Co-operation and Development producing guidance for PSPI setting based upon elements of a company’s management system. The UK Health and Safety Executive (HSE) also advocates a hazard and risk-based approach in their own guidance. For more information on the alternative guidance documents, visit the following internet links:

www2.oecd.org/safetyindicators/document/pg001.asp www.hse.gov.uk/pubns/books/hsg254.htm

UK – Inadequate safety measures on North Sea installationsThe UK HSE’s Offshore Division (OSD) produced a report in November 2007 in response to unacceptable accident statistics from deck and drilling operations offshore. The HSE warned that more needed to be done after more than half of 100 inspected offshore installations were found to be in a poor overall state. Speaking at the report’s launch, the Health and Safety Commission chair Judith Hackitt said: “Those in a position of leadership must ensure that systems, procedures, and best practice are adopted. The report highlights a number of examples of good practice but there is still the need for better learning and sharing. There were wide variations in performance across the sector and within companies.”

Ian Whewell, head of OSD said: “Our advice to the industry is clear – when looking at and testing systems and procedures on installations, companies must take an holistic approach and ensure that all those parts that need to work together to prevent a major incident do precisely that. The report identified that significant improvements in the sector could be achieved without major capital expenditure but through better planning, improved training and clear statements of performance standards in testing and maintenance routines.”

The report took some three years to compile and includes fixed, manned and unmanned installations, drilling rigs, floating production and floating production storage and offloading vessels. HSE’s findings included:

Many senior managers are not making adequate use of integrity management data and are not giving ongoing maintenance sufficient priority;

The role of asset integrity (which can be defined as the ability of an asset to perform its required function effectively and efficiently whilst protecting health, safety and the environment.) and concept of barriers in major hazard risk control is not well understood;

Companies need better key indicators of performance available at the most senior management levels to inform decision-making and to focus resources. Many management-monitoring systems tend to be overly biased to occupational risk data at the expense of major hazard precursors; and

Evidence of a decline in integrity performance which may hamper future field development and long term sustainability, with an adverse impact on morale in the workforce.

Asset integrity management is the means of ensuring that the people, systems, processes and resources that deliver integrity, are in place, in use and will perform when required over the whole lifecycle of the asset. Essential for the integrity of any installation are the Safety Critical Elements (SCEs). These are the parts of an installation and its plant (including computer programmes) whose purpose is to prevent, control or mitigate major accident hazards and the failure of which could cause or contribute substantially to a major accident. The HSE study focused primarily on the maintenance management of SCEs i.e. the management systems and processes aimed to ensure that SCEs are available when required.

More details of the report can be found by visiting www.hse.gov.uk/offshore/programme.htm.

5

Safety news from around the world

IntroductionMuch has been written about learning from incidents and accidents within the oil, gas and petrochemical industry, and there are plenty of papers and articles on the lessons to be learnt from the many significant incidents that have occurred in the past. Indeed, it is often said that there are no new incidents and, whilst this cannot be strictly true, there are many examples where learning points from incidents have been well documented and shared, but appear to have never been implemented comprehensively elsewhere. Further incidents happen, and the lessons are documented again, only for the cycle to be repeated. This paper explores some potential reasons for this, whilst at the same time identifying some examples where lessons have, or have not been learnt.

This paper is written from within the energy insurance sector and is focused at the larger losses. Within this sector (covering oil and gas exploration, stabilisation, refining and the petrochemical sector; mostly areas where there are significant hazards that include vapour cloud explosions) the engineers within the Global Marine and Energy Practice of Marsh (a team of predominantly Chemical Engineers specialising in Risk Engineering) are fortunate in that they get to visit and survey a wide variety of locations ranging from the smaller, single site, private companies to the larger, multi-site, private or public companies. This provides them with an almost unique view of how the larger hazards are tackled across the energy industry and across the world. These engineers are thus able to identify broad topics which affect the energy industry and, sadly, see and hear of the results of major incidents where the lessons learnt will be familiar to most.

One of the slight downsides of surveying all of these sites is that, for some of the examples, it is not possible to identify the source for client confidentiality reasons. Please be assured however, that the examples presented have been identified during actual surveys of operating assets around the world.

Lessons from the past: Are we learning, can we learn?

The effect of distance and timeDistance from the original incident, and elapsed time since the event appear to be two of the factors influencing how well lessons from major incidents are learnt. As we move further from the original incident (and sometimes not too far), and wait longer after the incident occurs, the less likely we see the lessons learnt and improvements made to help stop a similar incident occurring.

The author has operational experience on two COMAH1 assets in the United Kingdom. Even though these plants were operated by the same company, and managed by the same management team, there were differences in protection standards between the two plants. On the larger plant a fire on a gas system had led, in the past, to a pneumatic linear fire detection system being installed around the area where the gas was injected into a reactor on the plant. This had never been done on the smaller unit for reasons lost in time. These two plants faced each other across a road on a major petrochemical site, and yet lessons learned on one had not been translated onto the other.

On 4 January 1966 an operator taking a sample from the bottom of a propane sphere at Feyzin, in France, was splashed by a jet of propane and received burns to his face and arms. Following this initial injury propane continued to leak from the sphere, eventually being ignited by a car on a nearby road. Thirty minutes later the relief valve on the sphere opened and the releasing vapour ignited, with the sphere undergoing a BLEVE (boiling liquid expanding vapour explosion) after a further one hour. Ten minutes after this fire fighting was abandoned, and another BLEVE occurred half an hour later.

Marsh’s experience of pressurised storage spheres in France is very good. These storages are now generally installed over relatively steeply graded concrete floors, with all drainage routed to a large pit away from the sphere shadow area. The pit is typically protected by a number of fixed or semi-fixed foam pourers. Sample points are not installed in the sphere shadow area.

These positive protection features may or may not be due to local experience of a major incident. The features should, however, be contrasted with Marsh’s experience of pressurised storage sphere installations in other places in the world that are further from Feyzin. Our experience in Japan, for example, suggests

Iain CloughRisk Engineer Global Energy Risk Engineering, Marsh

6

Lessons from the past

that the standard of sphere design is much lower, with installations seen with very close spacing, no drainage (and even kerbs to hold liquids under the sphere until vaporisation or burning has occurred), poor access, multiple flanges and sampling systems still under the vessel. These standards are reflected in some recent Japanese-designed installations in some other countries.

In 1984 there was a catastrophic incident involving the BLEVE of many LPG (Liquefied Petroleum Gas) vessels at a site in the San Juan Ixhuatepec valley, to the north of Mexico City, which killed some 500 people and injured a further 4,000. Whilst some of the lessons appear to have been learnt, such as locating pressurised storage spheres and bullets further apart and providing fire resistant insulation on sphere legs and bullet saddles, others appear not to have been. At Mexico City some of the contributing factors were:

no independent high level alarm;

no trip of the feed line when high level is reached in the sphere;

bunds enclosing the base of the spheres, with no safe drainage;

firemains above ground where they are vulnerable to BLEVE damage; and

failure to control residential homes close to the site.

At least one of these, safe drainage, was implicated in the Feyzin incident some 18 years before. Some other of these concerns have been noted in recent major incidents in Europe, such as at Toulouse, where there was extensive damage to property close to the site.

One of the more infamous incidents in energy insurance history within the United Kingdom occurred on 1 June 1974 at the Nypro plant at Flixborough. Many pages have been written about the causes of the incident, but some of the other learning points are also important:

A management of change procedure is vital – a fact that now appears well learnt in most petrochemical companies we visit.

Many of the fatalities were inside the control room, and an improved blast resistant control building structure is suggested – again well learnt in general, although with some caveats described later.

Offices were destroyed in the event, and a safer location for office blocks should be sought. In the United Kingdom, and in some other western nations this is now being captured in ‘occupied buildings’ studies, which are often, surprisingly, identifying problems and requiring offices to be relocated. And these are being undertaken some thirty years after the Flixborough event had demonstrated the hazard exists. This suggests that the industry in general has not, until forced to do so, managed the hazards of having offices close to operating plant. Recent examples of where damage has occurred to office facilities include the Hickson and Welch incident at Castleford in 21 September 1992, and the Skikda LNG plant loss on 19 January 2004, the latter explosion destroying the office block on site, fortunately at a weekend when it was unoccupied. Temporary offices were, of course, one of the factors that gave such a high fatality count at the BP Refinery explosion at Texas City in March 2005.

On 21 October 1989 workers at the Phillips High Density Polyethylene plant at Pasadena began work to unblock three of the six discharge legs of the Nº.6 Rectors. An open valve, that should have been closed, allowed the release of some 38 tonnes of ethylene and isobutane, which subsequently exploded resulting in one of the largest losses within the energy industry. Again, a host of papers have been written on the root causes of the incident, but one of the lesser known recommendations is that ventilation intakes for buildings should be designed to prevent the intake of flammable gas, which was not the case at this site, even though it was a number of years after the Flixborough incident in the United Kingdom. A number of the sites we visit today, some fifteen years later, where pressurised and blast resistant control room blocks are now the norm, do not have trips on the pressurisation air to the building when toxic or flammable gases are detected, a system that is relatively cheap and easy to install.

7

Lessons from the past

The Piper Alpha disaster of 6 July 1988 has resulted in a number of recommendations; most appear to have been effectively implemented across the industry in the North Sea, mainly due to regulatory pressure, in a similar way perhaps to those improvements made to pressurised storage spheres in France after the Feyzin incident. However, these improvements have not been made with any consistency elsewhere in the world, with offshore platforms in the Gulf of Mexico only recently having safety cases produced for them, and a number of work permit handback issues seen in the second and third world countries, such as China.

Distance and time effects appear to be important, although these can be easily masked by factors such as prescriptive regulation (for instance in the North Sea, and for occupied building studies). However, a number of the lessons from these incidents do not appear to be mitigated at other sites around the world. Whether this is due to the costs of implementing some of the hardware changes required, or because many companies do not have formal processes for capturing the learning from events outside the company is not clear. On only one underwriting survey has the author seen a formal system for creating ‘virtual’ site incidents to capture off site learning, with the actions managed as if the incident had occurred on site.

Notably, some of the major oil, gas and petrochemical companies that we deal with do appear to learn more effectively, and impose their culture uniformly on sites around the world, with a consequent reduction in risk.

(Not) Learning from positive resultsThere are a number of good examples of where the industry does appear to have learnt from incidents, and has made improvements on a global basis. However, in general, we do not appear to be very good at learning from positive results, even where these have been incorporated into international standards. This is perhaps because if there is a positive result, it does not make the chemical engineering press, and has a much lower profile within the company as the loss is generally smaller. Because of these factors there is much less analysis done of what went well. In general, however, learning such as this is incorporated within national and international standards, all engineers then have to do is apply it.

On 25 December 1997 there was a major explosion in the air separation unit of the Shell plant at Bintulu, Sarawak. The investigation identified airborne carbon contamination of the air feed to the unit as one of the major contributory causes. Since then, a redesign of the common process for these air separation units, and the installation of additional hydrocarbon monitoring have greatly reduced the likelihood of a repeat incident. Without fail these improvements appear to have been made across the industry, with all sites visited having increased hydrocarbon detection installed. Why there has been such a consistent improvement is unclear, although it may be due to the relatively small number of players within this sector of the energy industry.

Many of the energy industry sites we visit have little in the way of electricity transformer and substation protection, although smelters and power stations are generally much better equipped. Typical protection includes full height fire walls between adjacent transformers, and fire wall protection between the transformer and the cable gallery area of the attached switchroom, the latter in particular is often missing. Some sites also choose to install sprinklers on transformers while others do not.

The variety of standards seen may be due to the relative hazard and importance given to these items, with transformers often installed with spares. This is only a valid argument if the passive protection installed is sufficient to prevent the escalation of any incident from one transformer to an adjacent unit. In addition, whilst the physical damage values from these types of events are relatively low, the downtime from such an incident can be higher, with the corresponding effect on the bottom line.

The energy industry does not appear to be particularly good at learning from similar industries where standards have been introduced, similar to the transformer fire protection standards discussed above. In addition, few companies conduct a formal gap analysis when standards change, to see where they differ from the best current practice, and to determine whether they should do anything to bridge the gap.

One example seen regularly is the fuel gas isolation standard for furnaces and heaters. Most modern good engineering standards generally require a double block and bleed valve arrangement on the fuel

8

Lessons from the past

gas to furnace and heaters, so that in the event of the furnace being shut down or tripped, the double isolation ensures a very low chance of fuel gas leakage into the firebox. On most companies risk matrices (often similar to the one above, in figure 1) correcting the deficiency is (or would be) ranked as having a Category 2 priority (as it falls in the ‘likely’ or ‘possible’ rows, and typically causes ‘major’ damage), although corrective action is not planned. Why this does not occur is not clear, although it could be a form of cultural blindness as described below.

Cultural challengesIt is possible that there may be a number of cultural barriers to learning from these major incidents. Kletz, 1993, identified time, lawyers (and litigation), fear of adverse publicity, internal procedure, disclosure of confidential information and commitment (of both companies and individuals) as barriers to publicising incident information, but this is a very western-centric viewpoint. Much of the growth in the energy industry is happening in the Middle East, and there are a number of relatively young, fast growing and now quite large, companies with significant assets. However, these companies have not been around long enough (or may have been around, but have recently grown from a much smaller base) to have heard about some of the incidents described above.

As part of this, some cultures and companies have been very isolated in the past (Iran being an example, following the Islamic Revolution), and have not had the opportunity to be informed about, or to learn about, these incidents.

A number of Middle Eastern cultures are very hierarchical, and do not easily permit a junior employee to question the wisdom of a more senior member of staff, or to go to higher levels within the organisation if they feel their concern warrants this. This was recently seen on an underwriting survey in this region where a vessel (which potentially could cause the largest physical damage loss on the site) had not been inspected since commissioning as the operations manager would not release it to the inspection manager (who was relatively junior). The inspection manager had not been able to ‘push’ the issue with other, more senior members of staff within the company, even though he was acutely aware that an inspection was warranted.

These fast growing companies also rely heavily on process licensors who, whilst generally providing an efficient process for the design and construction of a plant, operate with a different set of objectives from the site owner and operator. In the absence of company standards from the client, the licensor will have to fall back to their own standards, generally based on either international standards or the standards of a major repeat customer.

Figure 1: A generic risk assessment matrix

LIKELIHOOD CONSEQUENCES

SLIGHT (1) MINOR (2) MODERATE (3) MAJOR (4) CATASTROPHIC (5)

A - Almost certain Category 3 Category 2 Category 2 Category 1 Category 1

B - Likely Category 3 Category 3 Category 2 Category 2 Category 1

C - Possible Category 4 Category 3 Category 3 Category 2 Category 2

D - Unlikely Category 4 Category 4 Category 3 Category 3 Category 2

E - Very rare Category 4 Category 4 Category 4 Category 3 Category 3

Category 1 Extreme risk; should be brought to the attention of directors and immediately progressed

Category 2 High priority; requires attention of senior management and an action plan developed as a priority

Category 3 Moderate risk; requires action at the earliest opportunity and may require budget approval

Category 4 Low risk; opportunity for industry best practice initiative providing long term safety benefits

(AS/NZS 4360:2004)

9

Lessons from the past

References AS/NZS 4360:2004, Risk Management Standard. Kletz, T, 1993, Lessons from Disaster, IChemE. 1 COMAH – Control of Major Accident Hazards Regulations – the UK application of the Seveso II Directive. COMAH installations are deemed to have sufficient quantities of hazardous materials to present a major accident hazard risk

Licensing is a competitive business, and this can limit the loss prevention standards applied at design and initial construction, where the inclusion of higher levels of protection can lift the price of the bid, and may lead to the job being awarded to another company.

One example of this seen in Iran was of a number of relatively new plants on a multi-product site in Iran. Some of the plants have vapour cloud explosion (VCE) potential and so were equipped with blast resistant control rooms. However, plants without VCE potential were not so equipped, which leads to the relatively incongruous appearance of a blast resistant control room block (concrete walls, no windows, heavy, automatically closing doors) next to an airy, glass fronted building which controlled the plant to the other side. Here, the lack of a site standard for hazard assessment meant that vendors had fallen back on their own standards, without knowing what outside impacts were possible. The site culture was to respect the expert (the licensor) and so the two different control rooms were built alongside each other.

Even in the West our own company cultures can lead to ‘blindness’ when it comes to hazard mitigation: there is a high emphasis given to personnel safety (slips, trips, falls, contact with chemicals) which can lead to larger, but less frequently occurring, hazards being overlooked. In a number of locations around Europe for example, including some where the author has worked, there are large compressors forming single stream sections of the plant. There is often little in the way of fire detection and protection in the area of the compressor or the lube oil set, justified on the basis that it is relatively lightly manned in the area and no-one is likely to be hurt. However, damage to this machine could result in the inability to make product for some 12 months to allow the purchase and installation of a new machine, and if the company was not insured for business interruption then this could well lead to it closing.

In the case above reliance is also often made on the mobile response available on site. Whilst this resource is undoubtedly effective in many cases, little in the way of planning for such an event is generally made. Detailed pre-plans can be drawn up for fires in certain areas of the site, which can determine whether or not improvements need to be made to the current protection (mobile and fixed) arrangements.

The fear of litigation is also prevalent in the West. Many major incidents are often mired in the litigation process for many years, so that when the learning does become available it can be a significant time after the incident, when interest is lower and implementation of any recommendations becomes more difficult. There have been reported instances where investigators have been prevented access to the scene of major incidents for up to two months by ‘the lawyers’ – unfortunately the risk of litigation prevents us naming these incidents specifically.

ConclusionThis discussion attempts to look at why the lessons from some of the more significant incidents around the world do not appear to have been learnt and applied in a systematic manner. Recognised examples have been given of major incidents where the learning points arising from the incident were the same (in some cases) to those from incidents years earlier.

Why we do not always learn from these incidents is not clear, and can only really be a source of speculation. A number of examples and ideas have been raised above, but maybe the solution lies in the rate at which the average engineer within an operating company designs and builds new plants. Since this is low, recalling the learning from an incident in the past at the stage in the design when it is easily incorporated is difficult to manage, and easily missed. The answer is perhaps to risk assess the project with an open mind at a very early stage. Altering older plants costs much more money.

10

Lessons from the past

GeneralThe feedback with the GERE team suggested the inclusion of hydrogen detectors together with good ventilation in battery rooms where there is risk of hydrogen discharge becoming more common is seen as good practice. Regulations in some countries are quite specific, for example in France, regulation requires battery rooms having both (hydrogen) detection and ventilation in any battery room in addition to anti acid painting, bunding, eye washer. Other countries have less specific regulation, with some calling for ventilation only.

Specific standardsWe then considered the specific standards of a couple of major oil companies, together with the recommended approach from more widely available standards.

Oil company #1Company #1 practice recommends making provision for sufficient diffusion and ventilation of the gases from the batteries to prevent the accumulation of an explosive mixture in the room where the battery is installed. This is achieved by:

Calculation of air exchange requirements – based on the charge method and battery vendor’s estimate of H2 evolved.

Room temperature control – the room in which the batteries are located shall be provided with heating and cooling to maintain the room temperature within the limits specified by the battery vendors at both maximum and minimum loading.

Ventilation rate – for rooms/buildings containing equipment handling flammable materials shall be determined as per the specific requirements of NFPA 496.

Hydrogen gas detection in battery rooms

John Munnings-TomesSenior Risk Engineer Global Energy Risk Engineering, Marsh

The following short article started ‘life’ as a shared file note to the engineers within the Global Energy Risk Engineering team of Marsh, written as a result of a request for information on the subject of hydrogen gas detection in battery rooms.

BackgroundBatteries are widely used in the hydrocarbon process industries, notably in large numbers for providing emergency power to critical services such as distributed control systems, process logic controllers and emergency shutdown systems. The batteries are arranged in battery rooms, and are typically located within the main control room building or associated auxiliary buildings.

Various types of battery can be used, the most common being wet cell type batteries (e.g. lead-acid) and seal maintenance free valve regulated lead-acid, which produce hydrogen during charging and discharge.

A question was posed to the Global Energy Risk Engineering (GERE) team to ascertain the experience and use of hydrogen gas detectors in battery rooms where conventional vented lead-acid batteries are used, and where there is a risk of hydrogen forming during charging. Is good ventilation considered sufficient, with presumably an explosion proof exhaust fan?

The following captures the feedback from team members, and concludes with some suggested guidance for future consideration, and whilst this does not represent an exhaustive search on the subject we felt it worth sharing with a wider audience.

11

Hydrogen gas detection in battery rooms

Venting location – battery rooms, and any rooms containing toxic or flammable materials shall be vented directly to the atmosphere. No air from these rooms shall be recirculated to another room or other part of a building.

Access – battery rooms that are part of a control house building shall have direct access to the outside and shall not have any direct access to the control room.

Additional references that should also be taken into account are:

IEEE C2-2002 National Electrical Safety Code (ANSI/IEEE)

IEEE C2-2002 National Electrical Safety Code (ANSI/IEEE)

NFPA 70 National Electrical Code

NFPA 496 Standard for Purged and Pressurized Enclosures for Electrical Equipment (National Fire Codes, vol. 7)

NFPA 497 Recommended Practice for the Classification of Flammable Liquids, Gases, or Vapours and of Hazardous (Classified) Locations for Electrical Installations in Chemical Process Areas

Oil company #2 Based on recent project experience, company #2 recommends that hydrogen gas detection (catalytic type) be installed in battery room if a conventional vented lead acid battery is used, where hydrogen vapours are formed whilst charging. A Ni-Cd battery produces oxygen. In either case, the battery room shall be protected with an explosion proof exhaust fan. In the likely case of hydrogen production, the air shall be exhausted at the highest location in the building to avoid potential for hydrogen accumulation. In general, battery rooms should also be supplied with heat detection.

National Fire Protection Association (NFPA)From NFPA 850 (Recommended Practice for Fire Protection for Electrical Generating Plants and High Voltage Direct Current Converter Stations) – 7.8.5. “… Battery Rooms should be provided with ventilation to limit the concentration of hydrogen to 1% by volume…” (25% of LFL and in line with NFPA 496 and 497).

Other NFPA codes make reference to battery rooms and hydrogen and the need for adequate ventilation.

NFPA 76 (standard for fire protection of telecommunication facilities) has a more specific requirement in clause 8.4.2.1.5. “… Hydrogen gas danger level, methane gas danger level, battery room ventilation fan failure, and similar off-normal condition of safety-related items shall be immediately transmitted to the supervising station described in 8.4.1.5 or alarm monitoring centre described in 8.4.1.4 and shall be permitted to be displayed on the local fire alarm system as a supervisory signal…”.

Factory MutualFM global loss prevention data sheets also refer to sufficient ventilation and exhaust to avoid accumulation of an explosive hydrogen mixture. The aspect of temperature is also stressed with a figure of 25OC (77OF) provided to minimise the production of hydrogen.

ConclusionFrom the above, as a best practice approach; we consider there is sufficient justification to install hydrogen detection in battery rooms where there is risk of hydrogen venting from the battery (dependant on chosen battery technology). Additionally, ventilation should be provided to prevent hydrogen build-up, with ventilation equipment explosion proof and allowing evacuation at the highest elevation in the battery room, although the room should ideally be constructed so as to avoid ‘pocket’ potential. Venting should be direct to atmosphere and not be recirculated to any other room. Ventilation rate should be calculated by code to avoid a build-up of an explosive mixture of hydrogen. During venting design, consideration could be given to a normal venting rate, and then a higher rate activated upon hydrogen detection, alternatively to run at the higher venting rate continuously. Loss of venting should prompt an alarm condition.

Rooms should be kept at a temperature range inline with vendor requirements to minimise hydrogen evolution.

Heat detection should be considered – although arguably of limited value given the expected low combustible load in such areas. If part of a control room/auxiliary room complex where a high sensitivity smoke detection system is best practice then the battery room could be tied into such a system to identify fires at an incipient stage, i.e. cable overheating and smouldering.

Other room features should take cognisance of the hazardous features associated with battery acid, and include for bunding, resistive materials, spill clean-up facilities and eye wash/shower facilities.

12

Hydrogen gas detection in battery rooms

Process safety performance indicators: The end of the beginning

Process safety management Process safety management (PSM) is about reducing the risk of a major incident by identifying and controlling the hazards associated with the process. Application will also reduce the risk of lesser incidents associated with these and other hazards. Process safety performance indicators (PSPIs) will tell us how well process safety is being managed.

This is a topic that is gathering momentum. The process industry has a long history of major incidents that have been well-publicised along with the valuable lessons to be learned. No doubt there have been many more near misses that reinforce these lessons. It has been recognised that the focus on personal safety is just one aspect of the drive to prevent accidents and that there must be an increased emphasis on process safety. A major incident can cause as much harm to people in an instant as all the injuries that have been avoided in a decade of personal safety programmes. But it’s not a choice between personal safety and process safety programmes – both are vitally important in the industry’s drive to prevent harm to their people, the community and surroundings. However the indicators we use to measure personal safety programmes should not be taken as a wholly reliable indicator of the quality of process safety systems.

Shortcomings in process safety management have been clearly identified in major incidents around the world. This was brought into sharp focus in the Baker Report on the BP Texas City incident of 23 March 2005, and contains several references to process safety management issues. There is a clear expectation in the industry to do better on process safety.

Elements of PSMThe range of process safety activities is enormous – everything from testing the emergency shutdown systems to modelling the capacity of the flare system; from pressure testing a new piece of piping to the safely isolation of a pump for maintenance work; from the shift handover to a management of change review. They all matter because they can all prevent incidents if they are done well or cause incidents if they are not. These are the barriers that stop an incident before it starts or limit the impact once it gets going. Process safety management is about putting these barriers in place and maintaining them so that they work effectively. These barriers can be physical systems, logical systems or management systems; they rely heavily on people at all levels of the organisation to be competent, diligent and vigilant.

All of these barriers are interdependent. For example, closed systems are designed to physically cope with the operating pressure, logical systems are designed to control the pressure within the design limit, additional physical systems are installed to relieve the pressure if the logical system fails to control it; inspection and maintenance systems are designed to ensure integrity of the physical systems; instrument testing and calibration systems are designed to ensure the integrity of the logical systems; management systems such as procedures, competency and performance management and audits are designed to ensure that all of the other systems work effectively.

Measuring PSM performanceHow can we tell if these barriers are in place and if they are being maintained? Process hazard reviews on the design of new plant, as part of the management of change and at regular intervals on existing plant are all good practices to identify where these barriers are needed. These practices are also themselves barriers

Johnothan ConnorsRisk Engineer Global Energy Risk Engineering, Marsh

13

Process safety performance indicators

to prevent uncontrolled hazards leading to incidents. Effective maintenance of these barriers is measured by PSPIs. These can be applied across a wide span of activities over a range of time frames and at number of levels in the organisation. They can also be classified into leading indicators or inputs, which are associated with the causes; and lagging indicators or outputs which are associated with the results.

Typical sources of PSPIs can be provided by the major accident hazard studies and the safety case for the site; the incident and near miss records; lessons learned from major incidents across the industry. There is also that old standby – common sense and experience. The UK Health & Safety Executive document HSG 254 provides a useful framework to develop and select site-specific PSPIs. The approach taken by the UK regulator is to set an expectation for these measures to be established, to support individual organisations to work out the details and then to promote the best practices that emerge from the process.

Selecting relevant PSPIsEvery organisation will have different approach to PSPIs, although the development process will most likely follow a similar process. There may also be different drives behind the use of these measures. Different organisations could be using their PSPIs as a measure to improve, to provide assurance, to demonstrate compliance or to identify best practice. Irrespective of what’s driving these programmes, the fundamental purpose will be to prevent major accidents by controlling the hazards. The methods of selecting what to monitor could range from rigorous analysis to simply selecting a set of measures on the basis of experience. The number of measures could also vary from one organisation to another – some may concentrate on a small number of high level measures; others may have a plethora of measures with ownership throughout the organisation. There isn’t a single right answer to this question, other than the PSPIs to use should be aligned with the above fundamental purpose.

Given this degree of variation, a set of industry standard PSPIs is probably a long way off. It has been said that it is hard enough to align a number of sites in a single company let alone take on the entire industry. Notwithstanding this, the PSPIs we are beginning to see on our travels have a lot in common. Statistics on loss of primary containment, fires, safety instrument system testing – particularly where failure is ‘to danger’, overdue mechanical inspections, are quite regularly featured at the sites we visit. Differences often lie in the definition of the measures. For example an overdue inspection could be defined

by a specific day, month or even the year in which the inspection was due; loss of primary containment may be defined by different threshold quantities and may include or exclude flaring. What matters is that the delivery of the process safety programme is being measured and that improvements are being made as a result.

PSPIs play a supporting rolePSPIs are not the complete answer to process safety management; they are a part of the answer and fit into the overall programme. They can provide the clues to what might be going wrong but it is up to the organisation to fix the problems. This requires corporate support and direction and strong focused leadership – the authority and the will to take the appropriate action. A successful process safety management system depends on a competent and experienced workforce, high technical standards and effective systems of work. PSPIs work in tandem with the underlying programmes such as mechanical inspection, preventive maintenance, safe systems of work, hazard analysis, engineering design standards, project management and management of change, incident investigation, operating procedures, training and competency management and more besides. This list should sound quite familiar to all those who take part in risk surveys. A good set of PSPIs will tap into the programmes that establish and maintain the barriers. It also helps to have a well-designed plant with effective safety and protective features – but in many cases the essential features of a plant are fixed by the time of construction and the process safety systems have to fit the situation.

Where now for PSPIs?So how far has the global industry progressed on the application PSPIs? There is a clearer understanding of what they are, how to develop them and how to use them. Industry regulators strongly support and promote the use of PSPIs. Some major corporations are establishing standard measures for their operating sites – setting clear expectations and creating opportunities to develop best practices. It’s an evolutionary process - more PSPIs are being presented to us on insurance surveys and some of those are changing from one visit to the next. Momentum is building and the value is being recognised so it looks like PSPIs will be applied more widely and more effectively across the industry.

To paraphrase Sir Winston Churchill, we are “…at the end of the beginning…”.

14

Process safety performance indicators

Typical fired heater problems and root causesA fired heater is a piece of equipment of the utmost importance in the hydrocarbon processing industry (HPI), and incidents involving fired heaters pose a high risk and cost the HPI millions of dollars each year. If a fired heater is correctly designed, then it is the operating staff’s responsibility to work it correctly in order to achieve the desired results. Some of the most common root causes for fired heater problems include:

poor understanding of heater operation;

inexperienced operating staff; and

a lack of commitment to invest in developing and implementing good fired heater operating practices.

Fired heater operationBearing in mind the benefits of good heater operation such as safety, low maintenance and equipment costs, high efficiency and reliability, it is easy to see why plants should operate and maintain a fired heater properly.

Keeping safe is, however, not altogether straightforward. It is also not easy to achieve the benefits discussed above without a detailed knowledge of heater operation and the problems associated with it. Identifying the actual source of the problem and undertaking corrective action in good time is a central requirement to minimising and solving fired heater problems. Once a problem’s actual cause is known and understood, it is far more straightforward to take corrective action and draw up a mitigation plan. The following table will help to solve everyday fired heater problems and can assist in safe and efficient heater operation.

The checklist on the following pages identifies some thirty problems and their potential causes.

This item was originally published in Hydrocarbon Processing in March 2007 and has been summarised here with their kind permission. Its original author is Sanjay Patel, a process lead for Petro-Canada in Calgary.

15

Typical fired heater problems and root causes

Nomenclature

Carbon monoxide CO

Oxygen O2

Knockout KO

Induced draft fan ID

Nitrogen oxide and

nitrogen dioxide NOX

Coil outlet temperature COT

Tube Metal Temperature TMT

Air preheater APH

Low

exc

ess

air

Inad

equa

te p

rimar

y ai

r

Wro

ng b

urne

r se

lect

ion

Aft

erbu

rn

Too

muc

h dr

aft

Inco

rrec

t ai

r/fu

el r

atio

Exce

ssiv

e fir

ing

Burn

er t

ip w

orn

out

Poor

air-

fuel

mix

ing

Gas

mix

ture

ver

y le

an

Hig

h ex

cess

air

Poor

or

low

dra

ft

Plug

ged

burn

er t

ip

Dam

aged

bur

ner

tile

Inco

rrec

t or

ient

atio

n of

bur

ner

tip

Hig

her

than

nor

mal

hyd

roge

n co

nten

ts in

fue

l

Hea

vies

(C

4, C

5, e

tc.)

in f

uel g

as

Car

ry o

ver

of a

min

e so

lven

t in

fue

l gas

Part

icul

ate

mat

ters

in f

uel g

as

Hig

h tip

tem

pera

ture

No

fuel

gas

KO

dru

m o

r de

mis

ter

pad

dam

aged

Fuel

gas

line

not

insu

late

d an

d/or

tra

ced

Burn

er t

ip d

rill s

ize

too

smal

l

Stac

k or

ID f

an in

let

dam

per

not

open

Flam

e im

ping

emen

t

Hea

t flu

x sh

ift

Fuel

com

posi

tion

chan

ge

Fuel

pre

ssur

e hi

gh

Inad

equa

te a

ir su

pply

Poor

set

ting

of a

ir/fu

el r

atio

Inco

rrec

t ox

ygen

mea

sure

men

t

Stac

k da

mpe

r no

t se

t co

rrec

tly

Exce

ssiv

e he

ater

leak

s

Non

NO

X b

urne

r

Hig

h ni

trog

en in

fue

l

Hig

h ai

r pr

ehea

t

Hig

h fir

ebox

tem

pera

ture

Poor

bur

ner

cond

ition

/adj

ustm

ent

Hig

h st

ack

tem

pera

ture

Hig

h ra

diat

ion

loss

es

Poor

per

form

ance

of

air

preh

eate

r

Cok

e bu

ildup

Low

pas

s flo

w

Exce

ssiv

e fo

ulin

g of

con

vect

ion

sect

ion

Con

vect

ion

sect

ion

tube

fin

s bu

rnou

t

Tube

sup

port

fai

lure

Tube

exp

ansi

on r

estr

icte

d

Low

fue

l gas

pre

ssur

e

Not

eno

ugh

burn

ers

oper

atin

g

Uns

tabl

e fla

me

Poor

bur

ner

desi

gn

Low

er f

lue

gas

tem

pera

ture

tha

n no

rmal

Low

er a

ir in

let

tem

pera

ture

tha

n de

sign

Hig

her

than

nor

mal

sul

fur

cont

ents

in f

uel g

as

Air

leak

s in

side

air

preh

eate

r

Air

preh

eate

r no

t in

sula

ted

prop

erly

TMT

belo

w a

cid

dew

poi

nt t

empe

ratu

re

Hig

h pr

oces

s flo

wra

te

Hig

h ra

te o

f va

poriz

atio

n

Une

qual

hea

ter

pass

flo

w d

istr

ibut

ion

Une

ven

firin

g

Burn

er p

itchi

ng t

oo c

lose

Flame lit off

Flame impingement

Erratic flames

Flashback

Flame length high

Burner flames go out

Pulsating flame

Flame interaction

Burner tip plugging

Positive pressure at arch

High TMT of radiant tubes

Tube coking

Damaged tube/refractory

High temperature in convection box

High fuel gas pressure

High CO in flue gas

High O2 in flue gas

High NOX

High combustibles/emissions

Afterburn

Tube coking

Positive pressure inside the fire box

Low heater efficiency

Tube sagging/bowing

Tube bulging

High stack or flue gas temperature

Excessive corrosion of APH

Corrosion of convection tubes

Variation in COT

High pressure drop of radiant tubes

Heater vibration

Excessive noise

16

Typical fired heater problems and root causes

Nomenclature

Carbon monoxide CO

Oxygen O2

Knockout KO

Induced draft fan ID

Nitrogen oxide and

nitrogen dioxide NOX

Coil outlet temperature COT

Tube Metal Temperature TMT

Air preheater APH

Low

exc

ess

air

Inad

equa

te p

rimar

y ai

r

Wro

ng b

urne

r se

lect

ion

Aft

erbu

rn

Too

muc

h dr

aft

Inco

rrec

t ai

r/fu

el r

atio

Exce

ssiv

e fir

ing

Burn

er t

ip w

orn

out

Poor

air-

fuel

mix

ing

Gas

mix

ture

ver

y le

an

Hig

h ex

cess

air

Poor

or

low

dra

ft

Plug

ged

burn

er t

ip

Dam

aged

bur

ner

tile

Inco

rrec

t or

ient

atio

n of

bur

ner

tip

Hig

her

than

nor

mal

hyd

roge

n co

nten

ts in

fue

l

Hea

vies

(C

4, C

5, e

tc.)

in f

uel g

as

Car

ry o

ver

of a

min

e so

lven

t in

fue

l gas

Part

icul

ate

mat

ters

in f

uel g

as

Hig

h tip

tem

pera

ture

No

fuel

gas

KO

dru

m o

r de

mis

ter

pad

dam

aged

Fuel

gas

line

not

insu

late

d an

d/or

tra

ced

Burn

er t

ip d

rill s

ize

too

smal

l

Stac

k or

ID f

an in

let

dam

per

not

open

Flam

e im

ping

emen

t

Hea

t flu

x sh

ift

Fuel

com

posi

tion

chan

ge

Fuel

pre

ssur

e hi

gh

Inad

equa

te a

ir su

pply

Poor

set

ting

of a

ir/fu

el r

atio

Inco

rrec

t ox

ygen

mea

sure

men

t

Stac

k da

mpe

r no

t se

t co

rrec

tly

Exce

ssiv

e he

ater

leak

s

Non

NO

X b

urne

r

Hig

h ni

trog

en in

fue

l

Hig

h ai

r pr

ehea

t

Hig

h fir

ebox

tem

pera

ture

Poor

bur

ner

cond

ition

/adj

ustm

ent

Hig

h st

ack

tem

pera

ture

Hig

h ra

diat

ion

loss

es

Poor

per

form

ance

of

air

preh

eate

r

Cok

e bu

ildup

Low

pas

s flo

w

Exce

ssiv

e fo

ulin

g of

con

vect

ion

sect

ion

Con

vect

ion

sect

ion

tube

fin

s bu

rnou

t

Tube

sup

port

fai

lure

Tube

exp

ansi

on r

estr

icte

d

Low

fue

l gas

pre

ssur

e

Not

eno

ugh

burn

ers

oper

atin

g

Uns

tabl

e fla

me

Poor

bur

ner

desi

gn

Low

er f

lue

gas

tem

pera

ture

tha

n no

rmal

Low

er a

ir in

let

tem

pera

ture

tha

n de

sign

Hig

her

than

nor

mal

sul

fur

cont

ents

in f

uel g

as

Air

leak

s in

side

air

preh

eate

r

Air

preh

eate

r no

t in

sula

ted

prop

erly

TMT

belo

w a

cid

dew

poi

nt t

empe

ratu

re

Hig

h pr

oces

s flo

wra

te

Hig

h ra

te o

f va

poriz

atio

n

Une

qual

hea

ter

pass

flo

w d

istr

ibut

ion

Une

ven

firin

g

Burn

er p

itchi

ng t

oo c

lose

Flame lit off

Flame impingement

Erratic flames

Flashback

Flame length high

Burner flames go out

Pulsating flame

Flame interaction

Burner tip plugging

Positive pressure at arch

High TMT of radiant tubes

Tube coking

Damaged tube/refractory

High temperature in convection box

High fuel gas pressure

High CO in flue gas

High O2 in flue gas

High NOX

High combustibles/emissions

Afterburn

Tube coking

Positive pressure inside the fire box

Low heater efficiency

Tube sagging/bowing

Tube bulging

High stack or flue gas temperature

Excessive corrosion of APH

Corrosion of convection tubes

Variation in COT

High pressure drop of radiant tubes

Heater vibration

Excessive noise

17

Typical fired heater problems and root causes

BP Fire Safety Series | ReviewedTom AnthoniRisk Engineer Global Energy Risk Engineering, Marsh

BP Fire Safety Series, LNG Fire Protection & Emergency Response, BP International Limited, Institution of Chemical Engineers, Second Edition 2007.

The latest of the BP Process Safety Series booklets deals with liquefied natural gas (LNG). Actually this series is not so much a series, but more a collection of booklets by the same corporate author and the same publisher, dealing with safety related issues. The titles in the series have a widely varying topic range, scope and target audience. They range from publications on a specific activity, such as start-ups and shutdown, aimed at raising awareness amongst operators and maintenance technicians (with lots of practical incident examples), to comprehensive hazard reviews of an entire industry sector, such as this one on LNG, which is intended as reference material for design engineers and safety professionals; the series even includes a booklet on hotel fire safety.

As mentioned above, the booklet aims to be an essential reference tool for design engineers, project engineers, facility operators, safety professionals and emergency responders. Its purpose is to provide an overall understanding of LNG, and general LNG related safety issues, the potential emergency situations that may arise and how to deal with these incidents. This scope is reflected in the table of contents, which contains the following chapters:

18

BP Fire Safety Series | Reviewed

1. Introduction to LNG

2. LNG properties

3. LNG hazards

4. Tanks, containment and spill control

5. Jetties and marine facilities

6. Passive fire protection

7. LNG, gas and fire detection

8. Spill and fire control measures

9. Emergency response plans

10. Personal protective equipment

11. Codes and standards

12. References

Its 145 A5-sized pages make it probably a bit light to be able to meet its objective of being an essential reference tool. It is also rather strange that the appendix on LNG incidents does not mention the explosion on the Skikda plant (Algeria) on the 19 January 2004. However, the booklet does contain a lot of useful information.

Personally I believe that the most valuable contribution comes from the test results from a number of experiments carried out at the BP LNG fire school at Texas A&M University. Particularly the chapters on LNG, gas and fire detection and spill and fire control measures contain some good advice.

For example on gas detection, the booklet considers that the optimum configuration of gas detectors may consist of infra-red (IR) point detection supplemented by IR open path gas detection, and refers to experiments where the traditional industry configuration of point detectors would have missed the release completely. It also mentions that gas imaging technology is being developed which may have future specialist applications, but that, as yet, there are no standards or guidance to apply it. Unfortunately the booklet does not attempt to provide any guidance.

Regarding spill and fire control measures the booklet mentions that the volatility of LNG liquid is such that when spills occur, the vapours cannot be completely suppressed. The recommended method for dealing with unignited and contained LNG spillage therefore includes high-expansion foam and water curtains.

The recommended methods for dealing with LNG fires (bearing in mind that it may often be preferred not to extinguish LNG fires as evolving gas is burnt off in a controlled way) include:

water curtains which can be used to reduce radiant heat impact;

dry chemicals, which can extinguish an LNG fire; and

foam, which can reduce fire size and radiant heat intensity, but not extinguish the fire; experiments at the BP LNG Fire School at Texas A&M confirm that high expansion foam (500:1 ratio) provides the most effective response; because of the high radiant heat produced in an LNG fire, only fixed systems with specialised foam generators, should be considered.

Just for these test results the booklet is well worth a read.

19

BP Fire Safety Series | Reviewed

Fire and gas detection mappingComputer aided design to increase safety and reduce cost An article by a guest contributor, Kevin Keefe, of Micropack

IntroductionFire and gas detection systems should play a crucial role in loss prevention on many sites. Formal safety assessments such as quantified risk assessments often assume that fire and gas detection systems will reduce risks, yet their design is often a matter of “black art”; it is often difficult to quantify the parameters involved and there is little guidance to define required performance or to relate achieved performance to safety requirements.

Modern fire and gas detection designs tend to be towards hazard based approach featuring recognised and quantified hazards, for example ranging from highly sensitive items such as hydrocarbon gas compressors through to lower risk items such as produced water vessels.

Using highly developed assessment methods together with custom software the flame detection assessment, gas detection assessment and heat detection assessment packages are able to review and assess arrangements from initial designs through construction and onto existing installation. The assessments are used to optimise and validate designs and maybe used in formal safety studies.

Methodology of fire and gas mapping

Setting of performance targetsThe key to achieving a performance based in fire and gas detection systems design is to start with defining the required system performance. This should be done for all types of fire and gas detection equipment. For example, in terms of fire detection of ’flaming fires’ parameters such as flame size in radiant heat output (RHO) should be specified. For gas detection parameters such as gas cloud size and gas concentration should be specified. In both cases voting logic and response time must be clearly specified. The setting of such performance targets will usually require input, or agreement, from the client’s operations personnel, normally the control engineer and personnel familiar with the process and safety risks.

Typical steps to applying grades in hydrocarbon risk volumes for flame detection are:

Assign an ’average‘ grade of detection coverage throughout all hydrocarbon fire risk volumes (grade B).

Identify any parts of grade B areas where better detection is required, and assign them (grade A).

Review all remaining grade B areas for parts where cover is excessive and assign a lower performance (grade C).

Grade A is used for hydrocarbon risks, which are associated with particularly sensitive risks such as small hydrocarbon condensate pumps. Such risks will normally have well defined risk reduction measures (control actions), some of which may be active and need to be triggered by automatic fire detection. Grade A zones should extend a minimum of 1m from the plant to which it applies and segregated from grade C volumes by a further 2m of grade B.

Grade B is the ’normal‘ level of fire detection in hydrocarbon risk areas and is used wherever another Grade is not more appropriate. Typically grade B equipment will include items that are not sensitive to small fires such as oil separation vessels. Grade B zones should extend a minimum of 2m from any plant which is protected by it, or to the area boundaries if any are within 4m of the plant.

Grade C is used where the grade B level of detection is excessive, and so a reduced performance Grade is required. Typically grade C equipment will include items that have little or no flammable inventories such as produces water vessels. Grade C zones should not be within 2m of grade A volumes (i.e. there must be a grade B area between A and C), or hydrocarbon plant from which there is potential source of release, e.g. flanges or compression fittings (which will be grade A or B).

The gradings described above for flame detection coverage are based on targets used by many oil and gas production companies throughout the world.

20

Fire and gas detection mapping

Typical flame detection performance targets for offshore oil and gas production platforms, expressed in terms of RHO, are:

Grade Alarm Control Action

A 10kW 10kW

B 10kW 50kW

C 100kW 100 kW

Figure 1: Typical fire detection grade map

Grade map key Grade A = Red Grade B = Yellow Grade C = Green

Flame detection coverage assessmentFlame detection coverage can be assessed using software based mapping tool (“FDA”). The input requirements for this tool are performance targets, detector layouts and details of the detector types all obtained previously. The detectors are represented as 2 dimensional CAD files depicting each detector’s field of view. The performance targets for each area are set according to their local hazards and escalation risks. This information is stored in a ‘grade map’ file. A custom software system then ‘overlays’ each relevant detector’s footprint onto the grade map and, using a truth table, constructs a graphical image of

the coverage afforded by the area’s detectors. The finished graphical file is known as the ‘assessment’ file and provides an objective estimate of that area’s flame detection coverage. This analysis shows the typical interaction of flame detector coverage physical obstruction and hazard grading, an interaction that is virtually impossible visualise without computer assistance.

In the example shown below the areas shown in green meet the flame detection coverage targets, those areas in orange and yellow meet restricted targets while those in red have poor coverage and may require revision.

Figure 2: Typical fire detection assessment

Typical steps to applying grades in hydrocarbon risk volumes for gas detection are:The target gas cloud sizes are selected for each area based on the area’s volume, confinement and degree of congestion. Typical gas cloud performance targets are:

confined space(s), (E) inferring a 4 metre detection limit;

partially enclosed (PE), inferring 5 metre detection limit; and

open (O), inferring 10 metre detection limit.

A 74% 0% 23% 3% 0%

B 89% 8% 3% 0% 0%

21

Fire and gas detection mapping

Geometry of accumulationIt is a basic assumption of the methodology used in gas detection assessment (in keeping with the philosophy of damaging explosion overpressures) that the gas cloud can be modelled as a nominal sphere. This assumption (which is conservative because the ‘ideal’ spherical geometry encourages higher overpressures than the more realistic plume) permits a rapid and reasonably accurate assessment of detector coverage.

The gas cloud sizes considered are specified as 4m, 5m and 10m diameter clouds having volumes of 33m3, 65m3 and 523m3 respectively.

Each area assessed is represented as a regular orthogonal volume specified in terms of its length, width and height (or, using conventional cartesian coordinates, X, Y and Z dimensions)

Table 1: Definition of gas detection grade in terms of cloud size

Grade High gas Low gas

PE 5 metre 20 metre

O 10 metre 40 metre

E 4 metre 16 metre

For the setting of both fire and gas performance targets a full list of existing detection equipment and detector location drawings are required.

Figure 3 shows an example of gas grade map, indicating the performance targets.

Figure 3: Typical gas detection grade map

Gas detection coverage assessmentThe gas detection coverage to the target gas cloud sizes can be assessed using gas detection assessment software assessment tool. The target gas cloud sizes will be proposed for each area based on the area’s volume, confinement and degree of congestion as agreed previously.

The Fire and Gas plot plans are used to establish their proposed location on the installation, elevations will be required. These coordinates will be input into a software package, for analysis and assessment. This package objectively assesses the coverage of the existing gas detection system against the proposed performance target.

Gas Detection Assessment uses a number of simplifying assumptions in order to make it possible to assess sites. It is assumed that all gas detectors are either ‘point’ or ‘open path’ gas detectors, and that gas is detected if the accumulation envelopes a detector or intersects the track of an open path detector. Other types of inferential gas detector technologies including ultrasonic gas detection measures are not presently modelled, primarily because they effectively respond to release rates rather than gas concentrations.

Grade map key

Grade PE

HiGas Diam 5.00mLoGas Diam 20.00mH+L

Grade PE

HiGas Diam 10.00mLoGas Diam 40.00mH+L

Grade PE

HiGas Diam 4.00mLoGas Diam 16.00mH+L

22

Fire and gas detection mapping

Each area assessed is represented as a regular orthogonal volume specified in terms of its length, width and height (or, using conventional cartesian coordinates, X, Y and Z dimensions).

The assessment result is, by definition a three dimensional structure which cannot easily be rendered on two dimensional paper, and the results of the assessment are available both as a numerical summary and as a series of horizontal ‘slices’ through the volume. These slices are available at various intervals and, for clarity; one representative slice for each area will be reproduced in the study.

In the example shown below the areas shown in green meet the gas detection coverage targets, while if any area was shown in red this area would have poor coverage and may require revision.

Figure 4: Gas detection assessment

The use of fire and gas mapping clearly defines the risk and the precautions taken to detect fires and gas releases. The methods used allow the designer to be optimised the design to achieve the best possible balance between safety and economy. This practice improves safety and reduces operating costs by insuring that the number of devices used is minimised yet still maintaining the levels of safety required. All responsible fire and gas detector manufactures should offer this service.

For information on MICROPACK visit:

www.micropack.co.uk

or contact Kevin Keefe at:

KKeefe@micropack.co.uk

23

Fire and gas detection mapping

Loss report 2007August to December 2007

Chemical

Loss Number : 078451 Plant 1 was restarted on 8 August 2007 following planned shutdown for revamp and maintenance activities on a methanol plant. On the 9 August the plant experienced abnormal conditions in the synthesis reactor and a subsequent pressure build up in the system safety valve opening forced the shutdown of the plant. It was later discovered that the fourth catalyst bed was severely damaged. The incident has resulted in significant plant downtime, high maintenance and material costs.

Event Date : 09/08/2007

Country : Saudi Arabia

Unit Type : Synthesis

Equipment Type : Reactor

Event : Production Loss

Interruption : 58 days

Loss Number : 078535 A fire broke out at the biofuel plant in a preheating machine for rapeseed. An extraction system distributed the smoke throughout the building, resulting in injury to workers.

Event Date : 08/11/2007

Country : Germany

Location : Neuss, Nordrhein

Event : Fire

Injuries : 5

Loss Number : 078558 Three employees were carrying out maintenance operations, when one of them accidentally opened a valve releasing poisonous gas.

Event Date : 15/12/2007

Country : India

Location : Chembur, Mumbai

Event : Release

Plant Status : Maintenance

Fatalities : 1

Injuries : 2

Loss Number : 078567 Four workers were killed when a fire broke out near a cracking furnace. The four people were inspecting the plant at the time. The incident is expected to affect the facility for several months.

Event Date : 21/12/2007

Country : Japan

Location : Kashima

Material : Ethylene

Event : Fire

Plant Status : Shutdown

Fatalities : 4

The following is a regular update on selected losses reported or drawn to our attention during the period August 2007 to December 2007. Much of this data is drawn from external sources and we have been unable to verify the accuracy of some reports. Our thanks to all who have helped to provide this data.

24

Loss Report

Distribution

Loss Number : 078447 A lightning strike on a tank caused a massive explosion at the storage facility. One worker who was driving past the tanks at the time of the strike was killed and two others injured. Around 37% (nine million litres) of the fuel inventory was lost in the incident.

Event Date : 28/09/2007

Country : Brazil

Location : Sao Paulo

Unit Type : Storage

Equipment Type : Tank

Material : Fuel Oil

Event : Explosion

Cause : Storm

Plant Status : Construction

Fatalities : 1

Injuries : 2

Loss Number : 078475 A fire on gas condensate pipeline caused a force majeure on deliveries to the nation’s gas pipeline network. It is believed that an attempt to tap the line to siphon off the fuel was the cause of the fire. Production of about 300 million cubic feet of gas a day was deferred as a result of the fire and the gas plant feeding the pipeline has also been shutdown. Local press has reported that at least ten locals were killed in the incident but this has not been confirmed.

Event Date : 13/10/2007

Country : Nigeria

Location : Otor-Edo, Ughelli South

Unit Type : Pipeline

Equipment Type : Pipe

Material : Gas Condensate

Event : Fire

Cause : Vandalism

Plant Status : Shutdown

Fatalities : 10

Loss Number : 078484 Residents were forced to turn to wells and a local river for drinking water when a landslide caused a crude oil pipeline to rupture and polluted a reservoir. A large part of the oil was recovered within two days thanks mainly to the local residents.

Event Date : 29/08/2007

Country : China

Location : Yan’an, Shanghai Province

Unit Type : Pipeline

Equipment Type : Pipe

Material : Crude Oil

Event : Release

Cause : Landslide

Loss Number : 078486 Liquids which flowed into an already burning flare spilled into a flare pit. The incident occurred when a maintenance pig was being run through a new pipeline at the production facility.

Event Date : 10/09/2007

Country : United States

Location : Lisburne, Alaska

Unit Type : Flare

Equipment Type : Flare Pit

Event : Fire

25

Loss Report

Loss Number : 078487 A guerilla group was responsible for a number of explosions that ripped apart at least six oil and gas pipelines. It is believed that it would cost hundreds of millions of dollars in lost production and nine states would be affected. One oil pipeline was also targeted but this would not affect crude exports. The shortage was not expected to affect residential supplies but a number of businesses were forced to shut. Around 16,250 people were evacuated from five communities near the targeted pipelines. It was reported that it would take at least five days for repairs to be completed.

Event Date : 10/09/2007

Country : Mexico

Location : Veracruz

Unit Type : Pipeline

Equipment Type : Pipe

Material : Natural Gas

Event : Explosion, fire

Cause : Terrorism

Interruption : 5 days

Evacuated : 16,250

Loss Number : 078529 An earthquake in the south east of Dhaka caused damage to a gas pipeline. The subsequent fire was put out within an hour. No other damage was reported.

Event Date : 07/11/2007

Country : Bangladesh

Location : Chittagong

Unit Type : Pipeline

Equipment Type : Pipe

Material : Natural Gas

Event : Fire

Cause : Earthquake

Loss Number : 078555 An explosion occurred when two tankers were being filled with fuel from a bulk storage tank. Static electricity was thought to have ignited a flammable vapors.

Event Date : 06/12/2007

Country : China

Location : Tianjin

Unit Type : Storage

Equipment Type : Road Tanker

Material : Gasoline

Event : Explosion, fire

Cause : Spill

Plant Status : Operating

Injuries : 4

Loss Number : 078556 An underwater pipeline linking a refinery with storage facilties failed, causing approximately 100 tonnes of fuel oil to leak into a major river. A barrage was placed across the river to contain the oil. On 16 December 2007 fuel oil leaked into the River for a second time. The cause of the spill has not yet been determined.

Event Date : 10/12/2007

Country : Poland

Location : Wloclawek

Unit Type : Pipeline

Equipment Type : Pipe

Material : Fuel Oil

Event : Release

26

Loss Report

Loss Number : 078564 The fuel leak occurred and was ignited in a pipe leading to a tank, following welding work. The burning gasoline spilled into the retention pond but did not reach nearby storage tanks.

Event Date : 19/12/2007

Country : Canada

Location : Quebec

Equipment Type : Pipe

Material : Gasoline

Event : Fire

Cause : Leak

Loss Number : 078565 An explosion and fire occurred at a pipeline due to ignition of flammable vapors whilst thieves stole gasoline from a pipeline.Event Date : 25/12/2007

Country : Nigeria

Location : Agbagbo, Iru near Victoria Island, Lagos State

Unit Type : Pipeline

Equipment Type : Pipe

Material : Gasoline

Event : Explosion, fire

Cause : Vandalism

Fatalities : 45

Loss Number : 078575 Two employees died in an explosion and fire. Workers had shutdown the line to cut out a damaged piece of pipe and replace it with a new, pre-tested section, using special couplings on both sides. It was at the tail end of this repair and replacement process when the line was repressurised, causing a release through one of the couplings.

Event Date : 28/11/2007

Country : United States

Location : Clearbrook, Minnesota

Unit Type : Pipeline

Equipment Type : Pipe

Material : Crude Oil

Event : Explosion, fire

Cause : Leak

Plant Status : Maintenance

Fatalities : 2

27

Loss Report

E&P Offshore

Loss Number : 078426 Civilian helicopters airlifted 37 members of the 87 crew to safety following a fire in an engine room.Event Date : 14/08/2007

Country : United Kingdom

Location : North Sea

Unit Type : Drilling

Equipment Type : Rig

Material : Crude Oil

Event : Fire

Cause : Fire

Plant Status : Drilling

Loss Number : 078435 A sea captain was arrested for being three times over the legal alcohol limit after crashing his grain barge into a gas platform. It was reported that only “very slight” damage had been caused to the platform.

Event Date : 04/08/2007

Country : United Kingdom

Location : North Sea

Unit Type : Platform

Equipment Type : Platform

Material : Natural Gas

Cause : Collision

Loss Number : 078446 Three men of a crew of twelve died in an accident on a safety standby vessel in support of a drilling rig. It was reported that the men were securing an anchor chain in the bow of the vessel 25 miles of the coast when the accident occurred. An investigation has been launched into the cause of the incident.

Event Date : 23/09/2007

Country : United Kingdom

Location : Amethyst Gas Field, East Yorkshire

Unit Type : Drilling

Equipment Type : Vessel

Event : Mechanical Damage

Fatalities : 3

Loss Number : 078478 Twenty-one workers were killed and 63 rescued following a collision between a drilling platform and an oil rig. Two others were reported missing. High seas and wind gusts of 80 mph were the cause of the collision. The incident also led to a fuel spill which occurred some 32km offshore from the the port. Technicians were working to repair the damaged valve and stop the leak of fuel into the Gulf. On 3 December 2007 work began on dismantling the rig as heat from the near constant fire had destablised the structure. It is estimated that almost 13,000 bbls of oil had spilt into the Gulf of Mexico since the accident

Event Date : 23/10/2007

Country : Mexico

Location : Kab Oilfield, Gulf of Mexico

Unit Type : Platform

Equipment Type : Rig

Material : Crude Oil

Event : Release

Cause : Collision

Fatalities : 21

Evacuated : 63

28

Loss Report

Loss Number : 078479 All six passengers and crew were killed when their helicopter crashed soon after taking off from an offshore oil platform. The helicopter crashed into the Caspian Sea as it evacuated a sick worker from the platform.

Event Date : 12/10/2007

Country : Azerbaijan

Location : Caspian Sea

Unit Type : Platform

Equipment Type : Helicopter

Material : Crude Oil

Event : Mechanical Damage

Cause : Collision

Fatalities : 6

Loss Number : 078482 One worker was killed when a floating platform at a LNG terminal collapsed. A further seven were rescued following the incident. The four legged platform was left lying at an angle of less than 45 degrees to the sea, with most of it under water. A 2,000 litre diesel tank which was also in the water is thought to be safe although an anti-pollution vessel is on standby.

Event Date : 27/10/2007

Country : United Kingdom

Location : Milford Haven, Pembrokeshire

Unit Type : Platform

Material : LNG

Event : Mechanical Damage

Fatalities : 1

Loss Number : 078528 An alongshore section of a submarine gas pipeline broke, gas leaked causing a fire on the sea surface. The pipeline was closed, its cause is under investigation, although it was suspected that third party construction activities may have caused the initial leak.

Event Date : 06/11/2007

Country : China

Location : Hong Kong

Unit Type : Pipeline

Equipment Type : Pipe

Event : Fire

Plant Status : Shutdown

Loss Number : 078542 A fire broke out on the semi-submersible rig resulting in the evacuation of the crew. The incident is under investigation.Event Date : 04/12/2007

Country : Norway

Location : Troll Field

Unit Type : Drilling

Equipment Type : Rig

Event : Fire

Loss Number : 078549 Thousands of tonnes of oil leaked into the North Sea as it was being pumped from a platform to a tanker. The leak occurred in a pipe between the platform and the loading buoy. The pipe and buoy were shutdown. Four oil spill collection vessels were sent to the site, but clean up operations were hampered by severe weather.

Event Date : 12/12/2007

Country : Norway

Location : Statfjord Oilfield

Unit Type : Offshore

Equipment Type : Pipe

Material : Crude Oil

Event : Release

Cause : Leak

29

Loss Report

Loss Number : 078562 The spill originated in a leak in one of the 500mm underwater pipelines which connect the receiving terminal with the unloading buoy. All pumping from the tanker to the terminal ceased and limited the spillage to 94bbls. The spill rapidly reached the coastline, and strong winds impeded the clean up operation.

Event Date : 22/12/2007

Country : Uruguay

Location : Montevideo

Unit Type : Buoy/SBM/Terminal

Equipment Type : Pipe

Material : Crude Oil

Event : Release

Cause : Leak

Loss Number : 078571 A leak was detected in a valve connecting the riser to the floating production, storage and off-loading vessel (FPSO). The FPSO was shutdown for around 1 week awaiting replacement of the valve seal.

Event Date : 24/11/2007

Country : Canada

Location : Off Newfoundland

Equipment Type : Valve

Material : Crude Oil

Event : Leak

Cause : Valve Seal Failure

Loss Number : 078572 A major fire occurred on an offshore platform, resulting in the evacuation of most of the platform’s personnel. The fire was thought to have started in the turbine section and was extinguished after around two hours.

Event Date : 25/11/2007

Country : United Kingdom

Location : Offshore - Sumburgh, Shetland (Thistle Alpha)

Unit Type : Offshore platform

Equipment Type : Turbine

Event : Fire

Plant Status : Operating

Evacuated : 116

Loss Number : 078576 A fire broke out on board a drill-ship when a gas leak occurred. The cause is under investigation.Event Date : 28/11/2007

Country : Brazil

Location : Campos Basin

Unit Type : Drilling

Material : Natural Gas

Event : Fire

Cause : Leak

Plant Status : Shutdown

Injuries : 7

30

Loss Report

E&P Onshore

Loss Number : 078488 An explosion near a natural gas well destroyed a tank battery and caused damage to two vehicles. It is believed that a spark ignited flammable vapors in the area. The incident occurred as workers had arrived to pump water from the tank battery. The fire was visible from several miles away and the explosion cracked windows a few miles away.

Event Date : 13/09/2007

Country : United States

Location : Granbury, Texas

Equipment Type : Well

Material : Natural Gas

Event : Explosion

Cause : Explosion

Loss Number : 078551 One man died and a second injured in a pressure release at a natural gas well, after a valve gave way on a well being capped.Event Date : 03/12/2007

Country : United States

Location : Jefferson Township, Green County, Pennsylvania

Unit Type : Drilling

Material : Natural Gas

Event : Release

Cause : Material Failure

Fatalities : 1

Injuries : 1

Loss Number : 078552 A well was flared when high pressure overcame the pressure of the drilling fluids in the well and gas began to flow towards the surface. The flare was lit, but the pressurised gas caused such an intense flame that the rig was engulfed with fire. It is estimated to take up to 5 weeks to construct a site to drill a relief well.

Event Date : 09/12/2007

Country : Canada

Location : Tumbler Ridge, British Colombia

Equipment Type : Rig

Material : Natural Gas

Event : Blowout

Fertiliser

Loss Number : 078463 An ammonia leak occurred at the Fertilizer Plant due to a failed pump. 47 people were affected only 18 were admitted for observation.

Event Date : 06/08/2007

Country : United States

Location : Coffeyville, Kansas

Unit Type : Ammonia

Equipment Type : Pump

Material : Ammonia

Event : Release

Injuries : 18

31

Loss Report

Loss Number : 078581 A spark of a light bulb caused the deflagration of chemical agent which was being handled in a warehouse. A second explosion occurred in the mouth of the hopper of a mixer immediately after the initial incident.

Event Date : 20/11/2007

Country : Spain

Location : Lodosa, Vizcaya

Material : Unknown

Event : Explosion, fire

Injuries : 3

Gas Processing

Loss Number : 078532 Five contract workers were injured in a flash fire while completing routine, scheduled maintenance. The cause is under investigation.

Event Date : 15/11/2007

Country : United States

Location : Permont, Texas

Event : Fire

Plant Status : Maintenance

Injuries : 5

Loss Number : 078536 A fire caused by a hydrogen gas explosion at the natural gas methanol complex injured 9 workers and caused significant damage to electrical cables.

Event Date : 08/11/2007

Country : Algeria

Location : Arzew

Material : Hydrogen

Event : Explosion, fire

Cause : Explosion

Plant Status : Operating

Injuries : 9

Loss Number : 078577 A fire broke out while workers were welding a plate on a pipeline, killing 38 people and injuring 60. The exact cause of the incident was not disclosed.

Event Date : 18/11/2007

Country : Saudi Arabia

Location : Eastern Province

Unit Type : Pipeline

Equipment Type : Pipe

Material : Natural Gas

Event : Fire

Fatalities : 38

Injuries : 60

Loss Number : 078583 On 6 August 2007 at 17:39 hours a cold box ruptured/exploded along the south-west face of one of the air separation units causing extensive damage to the cold box and adjacent equipment. Seven contractors working on a project adjacent to the site of the explosion were exposed to Perlite insulation and were treated for asphyxiation.

Event Date : 06/08/2007

Country : Saudi Arabia

Location : Al Jubail

Unit Type : Oxygen

Equipment Type : Cold Box

Event : Explosion

Plant Status : Operating

Injuries : 7

32

Loss Report

Oil Sands Facility

Loss Number : 078448 A fire which started in one of the two oilsand upgraders was quickly extinguished. The fire resulted in emissions and fumes being released and the area near the incident was evacuated as a precaution.

Event Date : 02/10/2007

Country : Canada

Location : Fort McMurray, Alberta

Unit Type : Upgrader

Material : Crude Oil

Event : Fire

Cause : Leak

Interruption : 1 days

Refinery

Loss Number : 078434 A fire broke out in the crude unit of a refinery but was brought quickly under control and allowed to safely burn itself out. Facilities heavily damaged.

Event Date : 16/08/2007

Country : United States

Location : Mississippi

Unit Type : Crude Distillation

Equipment Type : Flange

Material : Crude Oil

Event : Fire

Cause : Fire

Loss Number : 078457 One person was killed and three injured following a blast at an oil refinery. It is believed that an air cooling system in the catalytic reformer area caught fire causing the explosions.

Event Date : 09/10/2007

Country : Chile

Location : Concon

Unit Type : Catalytic Reforming

Material : Gasoline

Event : Explosion, fire

Cause : Fire

Fatalities : 1

Injuries : 3

Loss Number : 078480 A fire broke out on the C5/C6 Isomerisation Unit at the 220,000 bbl/d refinery following an explosion. The fire damaged a key production unit of the refinery and a preliminary investigation into the cause of the blaze indicated that the fire had taken place in the Dehexanizer Column. It is believed that the fire was ignited by a leak of petroleum gas. Damage from the blaze was largely contained to a dehexanizer tower but this impacts the operation of several other units within the refinery including the reformer which is the only source of hydrogen production at the site. As several processes are hydrogen dependent this severely restricts the site operation. It is estimated that it will take up to a month to resume full operations and the refinery is currently running at around 50% of normal levels. Witnesses described flames 100ft high and shaking homes up to 14 miles away after the reported blast late in the morning.

Event Date : 31/10/2007

Country : United Kingdom

Location : Coryton, Essex

Unit Type : Isomerisation

Equipment Type : Column

Material : Gasoline

Event : Explosion, fire

Interruption : 30 days

PD Loss : US$15million

33

Loss Report

Loss Number : 078496 A gas leak in the 60,000 bbl/d refinery’s hydrocracking unit caused an explosion. Operations at the refinery continued although some units were scaled back. Around 685 pounds of sulphur dioxide was emitted during the incident from both burning gasses at the flare and the fire. A nearby chemical company, which treats the refiners sulphur-bearing gases also reported flaring sulphur dioxide in a major malfunction following the fire.

Event Date : 17/10/2007

Country : United States

Location : Lockwood, Montana

Unit Type : Hydrocracking

Equipment Type : pipe

Event : Explosion

Cause : Leak

Loss Number : 078499 Power was accidentally cut to a crude distillation unit during maintenance on a separate units electrical system. Event Date : 23/10/2007

Country : United States

Location : Old Ocean, Texas

Unit Type : Crude Distillation

Material : Crude Oil

Event : Production Loss

Cause : Power Failure

Plant Status : Maintenance

Loss Number : 078500 One worker was killed in a fire that occurred as he was trying to open valves as part of routine maintenance a the refinery. One of the valves which was blocked suddenly opened releasing gas which exploded throwing the worker against an electrical cabinet.

Event Date : 25/10/2007

Country : Algeria

Location : Skikda

Equipment Type : Valve

Material : Hydrocarbons

Event : Fire

Plant Status : Maintenance

Fatalities : 1

Loss Number : 078512 An upgrader which converts tar from oilsands into synthetic crude, was shutdown after a fire damaged one of two residue hydroconversion units at the facility following a gas leak. Attempts to restart the undamaged unit was hampered due to the bitterly cold weather in the region. Output at a 98,000 oil refinery was also being affected as it is relied upon the upgrader for its supply of synthetic crude. Diesel supplies in the region were cut as a result of the fire with some gas stations running out of fuel.

Event Date : 19/11/2007

Country : Canada

Location : Fort Saskatchewan, Alberta

Unit Type : Upgrader

Equipment Type : Hydroconversion

Material : Natural Gas

Event : Fire

Cause : Leak

Loss Number : 078518 A continuous reformer unit used in the production of gasoline was damaged during a thunderstorm, resulting in the shutdown of the refinery for about one month.

Event Date : 04/11/2007

Country : United States

Location : Oahu

Unit Type : Reforming

Material : Gasoline

Event : Production Loss

Cause : Storm

Plant Status : Commissioning

34

Loss Report

Loss Number : 078520 A spill that drained 65 barrels of crude oil from a tank occurred, after vandals broke padlocks and opened isolation valves on the tank. 41 of the 65 barrels were recovered.

Event Date : 05/11/2007

Country : United States

Location : Cornplanter Township, Pennsylvania

Unit Type : Storage

Cause : Sabotage

Loss Number : 078522 Electrical Contractors were preparing for unit overhauls when a power failure occurred. Heated feedstock stopped flowing through tubes in a heater which resulted in the rupture of a tube causing an explosion and fire on the hydrotreater.

Event Date : 08/11/2007

Country : United States

Location : Port Arthur, Texas

Equipment Type : Hydrotreater

Event : Explosion, fire

Cause : Power Failure

Plant Status : Operating

Injuries : 1

Loss Number : 078525 The incident occurred in the Wastewater Treatment Plant, where flammable hydro-carbons accumulated and were subsequently ignited. The fire was extinguished within an hour.

Event Date : 12/11/2007

Country : Portugal

Location : Leca de Palmeira, Matosinhos

Equipment Type : Waste Water/Effluent treatment

Material : Hydrocarbons

Event : Explosion, fire

Plant Status : Maintenance

Injuries : 2

Loss Number : 078526 Equipment failure resulted in the release of hydrogen sulphide gas and a small amount of crude. The refinery was shutdown until such time repairs could be made and the operation could continue.

Event Date : 15/11/2007

Country : United States

Location : Santa Maria, California

Cause : Equipment Failure

Plant Status : Shutdown

Loss Number : 078527 Three construction workers were injured when a “small plume” of sulphur dioxide was released. The release occurred from one of the sulphur removal plants.

Event Date : 15/11/2007

Country : United States

Location : Carson, California

Unit Type : Sulphur

Material : Sulphur Dioxide

Event : Release

Injuries : 3

Evacuated : 50

35

Loss Report

Loss Number : 078539 A fire occurred on a storage tank at a refinery.

Event Date : 01/12/2007

Country : United States

Location : Saint Paul Park, Minnesota

Material : Fuel Oil

Event : Fire

Plant Status : Maintenance

Fatalities : 1

Loss Number : 078544 A fire broke out in the Vacuum Distillation Unit which produces feedstock for the production of lubricants. The fire was caused by a leak from a straight section of pipe just a few pipe diameters from a bend. The event initially resulted in the shutdown of crude feed, but the refinery was soon able to resume production, albeit at a reduced rate.

Event Date : 06/12/2007

Country : South Africa

Location : Durban

Unit Type : Vacuum Distillation

Equipment Type : Flange

Event : Explosion, fire

Cause : Leak

Plant Status : Operating

Loss Number : 078545 Equipment failure resulted in the spill of 33,600 gallons of crude oil and processed water into a dried-up stream. The incident occurred after an injection pump failed on a spill pond, and the alarm system also failed to alert anyone of the incident. Vacuum trucks were used to collect the oil which had flowed half-mile downstream.

Event Date : 07/12/2007

Country : United States

Location : Santa Maria, California

Equipment Type : Pump

Material : Crude Oil

Cause : Equipment Failure

Plant Status : Shutdown

Loss Number : 078568 Rim seals on two tanks storing crude oil caught fire, no one was injured and the crude oil stored in both tanks was not compromised.

Event Date : 19/11/2007

Country : Malaysia

Location : Port Dickson, Malaysia

Unit Type : Storage

Material : Crude Oil

Event : Fire

Loss Number : 078570 Lighting struck a crude oil tank, sparking a major fire. The lightning hit a tank filled with 500 barrels of oil, the fire spread to a tank nearby containing gas which exploded. Firefighters contained the fire, preventing it from spreading to other nearby tanks.

Event Date : 21/11/2007

Country : United States

Location : Hardin, Texas

Unit Type : Storage

Material : Crude Oil

Event : Explosion, fire

Cause : Storm

Evacuated : 20

36

Loss Report

Loss Number : 078580 A storage tank at a refinery containing more than seven million litres of gasoline caught fire, apparently being struck by lightning. The fire was allowed to burn out, which took approximately 3 days. The refinery throughput was reduced to 75% of its normal level during that period.

Event Date : 19/11/2007

Country : South Africa

Location : Durban

Unit Type : Storage

Equipment Type : Tank

Material : Gasoline

Event : Fire

Cause : Storm

37

Loss Report

Marsh’s Marine and Energy training courses 2008

Energy Insurance and Risk Management Course

2 – 5 March 2008, Dubai, U.A.E.This four day intensive course is particularly suitable for people who need to further develop their knowledge and understanding of energy insurance. This course offers a foundation in all aspects of business relating to risk management issues. Previous courses have attracted delegates from many oil, gas and petrochemical, and insurance companies. The speakers will consist of insurance practitioners from our Middle East and North Africa Practice and selected guest speakers. Knowledge transfer is delivered through formal presentations, workshops and case studies. Delegates will be expected to actively participate in a team presentation.

The cost of this course is US$3,250.00 per delegate, which covers all course material, lunches on each of the four course days and at least two social events. Travel, accommodation and allied expenses are borne by the delegates.

Energy Insurance and Risk Management Course

22 – 25 April 2008, London, U.K.This five day intensive course is particularly suitable for people who have recently commenced a career in energy insurance and who requires a foundation in all aspects of the business. The course covers the principles of energy insurance relating to risk management issues, which will give the delegate a broader understanding of the subject within their present role.

During the five days of the course, delegates will be involved with various case studies and exercises. The speakers will consist of insurance practitioners from the Global Marine and Energy Practice of Marsh and sister companies, augmented by external speakers, usually including a Risk Manager, Underwriter and Loss Adjuster. Delegates will be expected to actively participate in a team presentation.

The cost of this course is £2,100.00 plus vat per delegate, which covers all course material, lunches on each of the five course days and at least two social events. Travel, accommodation and allied expenses are borne by the delegates.

Energy Insurance and Risk Management Course

12 – 15 May 2008, SingaporeThis four day intensive course is particularly suitable for people who need to further develop their knowledge and understanding of energy insurance. This course offers a foundation in all aspects of business relating to risk management issues. Previous courses have attracted delegates from many oil, gas and petrochemical, and insurance companies. The speakers will consist of insurance practitioners from our Asia Energy Practice and selected guest speakers. Knowledge transfer is delivered through formal presentations, workshops and case studies. Delegates will be expected to actively participate in a team presentation.

The cost of this course is US$3,250.00 per delegate, which covers all course material, lunches on each of the four course days and at least two social events. Travel, accommodation and allied expenses are borne by the delegates.

38

Marsh's Marine and Energy training courses 2008

Energy Insurance and Risk Management Course

2 – 5 March 2008, Dubai, U.A.E.This four day intensive course is particularly suitable for people who need to further develop their knowledge and understanding of energy insurance. This course offers a foundation in all aspects of business relating to risk management issues. Previous courses have attracted delegates from many oil, gas and petrochemical, and insurance companies. The speakers will consist of insurance practitioners from our Middle East and North Africa Practice and selected guest speakers. Knowledge transfer is delivered through formal presentations, workshops and case studies. Delegates will be expected to actively participate in a team presentation.

The cost of this course is US$3,250.00 per delegate, which covers all course material, lunches on each of the four course days and at least two social events. Travel, accommodation and allied expenses are borne by the delegates.

Energy Insurance and Risk Management Course

22 – 25 April 2008, London, U.K.This five day intensive course is particularly suitable for people who have recently commenced a career in energy insurance and who requires a foundation in all aspects of the business. The course covers the principles of energy insurance relating to risk management issues, which will give the delegate a broader understanding of the subject within their present role.

During the five days of the course, delegates will be involved with various case studies and exercises. The speakers will consist of insurance practitioners from the Global Marine and Energy Practice of Marsh and sister companies, augmented by external speakers, usually including a Risk Manager, Underwriter and Loss Adjuster. Delegates will be expected to actively participate in a team presentation.

The cost of this course is £2,100.00 plus vat per delegate, which covers all course material, lunches on each of the five course days and at least two social events. Travel, accommodation and allied expenses are borne by the delegates.

Energy Insurance and Risk Management Course

12 – 15 May 2008, SingaporeThis four day intensive course is particularly suitable for people who need to further develop their knowledge and understanding of energy insurance. This course offers a foundation in all aspects of business relating to risk management issues. Previous courses have attracted delegates from many oil, gas and petrochemical, and insurance companies. The speakers will consist of insurance practitioners from our Asia Energy Practice and selected guest speakers. Knowledge transfer is delivered through formal presentations, workshops and case studies. Delegates will be expected to actively participate in a team presentation.

The cost of this course is US$3,250.00 per delegate, which covers all course material, lunches on each of the four course days and at least two social events. Travel, accommodation and allied expenses are borne by the delegates.

For all courses the following conditions apply:

Conditions: Shortly after confirmation of the booking an invoice will be sent to you. Payment is required no later than 30 days before the course starts, or immediately for bookings made within the eight weeks of the beginning of the course.

Cancellations: Bookings may be cancelled at any time up to 30 days before the start of the course and a refund will be made, less a 20% administration fee. No refund will be made for cancellations made after that date, although a substitute delegate will be accepted at any time in place of the person booked. If Marsh has to cancel the event for any reason, a full refund will be made. We reserve the right to change details of the programme and speakers if the need arises.

For ENERGY course enquiries and bookings, please contact:

Carol-Joan Smart Training Manager

Global Marine and Energy Practice Marsh Ltd Tower Place London EC3R 5BU ENGLAND

Email: Carol-Joan.Smart@marsh.comTel: +44 (0)20 7357 2696

For MARINE course enquiries and bookings, please contact:

Stephen J Harris Senior Vice President

Global Marine and Energy Practice Marsh Ltd Victoria House Queens Road Norwich, NR1 3QQ ENGLAND Email: Stephen.J.Harris@marsh.comTel: +44 (0)1603 207 324

Marine Training CoursesThe Global Marine and Energy Practice of Marsh has been organising Marine Insurance courses in the UK and overseas since 1997. These courses are designed to equip those who work in Marine Insurance or those in the maritime industries who need to have a working knowledge of the main classes of marine insurance, the clauses and conditions used, an understanding of the various parts of the maritime industry, plus the different vessel types used.

They are suitable for:

Those who are new to marine insurance and wish to have knowledge of the various classes,

Those who have extensive knowledge in only one or two areas and who wish to widen their knowledge to include other classes, and

Those not directly employed in the insurance industry but for whom marine insurance is an important consideration in their own business operations.

In the past ten years these highly popular Marine Insurance courses have attracted delegates from over thirty countries from around the world and from many spheres of activity:

Insurance Brokers (UK and Overseas), Insurers (UK and Overseas), P&I Clubs, Finance Houses and Banks, Vessel Charterers, Port Authorities and Terminal Operators, Surveyors, Cargo Freight Forwarders, Cargo Owners and NVOCCs, Telecommunications Companies, Shipowners and Managers, National Government, Marine Lawyers, and Shipbuilding, Salvors and Repairers.

39

Marsh's Marine and Energy training courses 2008

About Marsh’s National Oil Companies Conference 2008 Marsh’s second annual National Oil Companies (NOC) Conference is the landmark industry event specifically devoted to NOCs and addresses the risk issues and challenges they face. The 2008 event will be held at the Madinat Jumeirah in Dubai, February 25-27, 2008.

Continuing the dialogue started in 2007 amongst NOCs, the 2008 conference will provide a forum for you to discuss ideas and experiences with your peers, look at vital industry issues such as operational, financial and strategic risk in NOC operations as well as opportunities to unlock the “upside” of risk to the benefit of your organisations.

An impressive array of speakers includes executives from NOCs, professional service firms, governments, and senior management from Marsh & McLennan Companies (MMC). They include:

Edward Morse, Managing Director and Chief Energy Economist, Lehman Brothers; Dr. Mohammed Benayoune, Former CEO of Aromatics Oman LLC and Oman Polypropylene LLC, Director and Head Coach with the Achievement Centre International; James Ferguson, Vice President and Deputy General Counsel, Halliburton; Matthew R. Simmons, Chairman, Simmons & Company International; Sheikh Faisal Al Thani, Sr. Director and Head of Business Development – Middle East, Maersk Oil (Qatar); Andreas Bork, Treasurer, Shell (Qatar); Kevin Jarman, Chief Executive Officer, Matthews Daniel; Dennis Culligan, Director, Longdown Associates; Petter Kapstad, Chief Risk Officer, StatoilHydro; Dr. José Manuel Carrera, Managing Director – Risk Management, Petróleos Mexicanos (PEMEX); Saleh Al Nazha, President, Tasnee; David Anderson, Risk Manager, BP; Gaute Samuelsberg, Head of Captive and Corporate Insurance, StatoilHydro; Martyn Black, Risk Management Consultant, Saudi Aramco; Wayne Jones, Partner, Clyde & Co; Paul Wordley, Partner, Holman Fenwick Willan; Michael Boyette, Risk Management Consultant, Saudi Aramco.

During the conference, there will also be a variety of interesting and exciting social events. On Tuesday (February 26) we will host a dinner at the exclusive Madinat Jumeirah resort with a performance by The City of London Sinfonia (the world renowned chamber orchestra).

Marsh’s National Oil Companies Conference 2008 is shaping up to be another great event. We hope that you are able to participate and benefit from the generation of creative solutions, thought leadership and networking opportunities.

February 25–27, 2008Madinat Jumeirah, Dubai, UAETo find out more and register go to: http://programs.regweb.com/marsh/2008NOC

If you need further assistance or have any questions contact Kirsty Mackinnon: Tel: +971 4 212 9386 |

email: kirsty.mackinnon@marsh.com

Alternatively call Judy Figueroa +1 212 345 5244

Unlock the opportunities others can’t. Find the upside.

This year’s conference

registration fee is complimentary to all

delegates. Travel and accommodation

fees still apply.

The information contained in this publication provides only a general over-view of subjects covered, is not intended to be taken as advice regarding any individual situation, and should not be relied upon as such. This publication is intended for professionals in the energy, petrochemical, oil, gas, risk man-agement, and insurance industries.

Insureds should consult their insurance and legal advisors regarding specific coverage issues. All insurance coverage is subject to the terms, conditions, and exclusions of the applicable individual policies. Marsh cannot provide any assurance that insurance can be obtained for any particular client or for any particular risk.

This document or any portion of the information it contains may not be cop-ied or reproduced in any form without the permission of Marsh Ltd., except that clients of any of the MMC companies need not obtain such permission when using this report for their internal purposes, as long as this page is included with all such copies or reproductions.

Marsh is part of the family of MMC companies, including Kroll, Guy Carpenter, Mercer, and the Oliver Wyman Group (including Lippincott and NERA Economic Consulting).

In the United Kingdom Marsh Ltd is authorised and regulated by the Financial Services Authority for insurance mediation activities.

Copyright 2008 Marsh Ltd. All rights reserved

For further information, please contact your local Marine and Energy Practice:

http://www.marsh.com