UKOOA, Guidelines for the Management of Safety Critical Elements 2007, 2007-04-10

Licenced to: Jeremy Goddard. Single user licence only.IMPORTANT: This file is subject to a licence agreement issued by the Energy Institute, London, UK. All rights reserved. It may only be used in accordance withthe licence terms and conditions. It must not be forwarded to, or stored or accessed by, any unauthorised user. Enquiries: e: [email protected] t: +44 (0)207 467 7100

Guidelines for the management of safety critical elements

2nd edition

An IP Publication

Published by the Energy Institute


Energy Institute61 New Cavendish Street

London W1G 7AR, UK

t: +44 (0) 20 7467 7157

f: +44 (0) 20 7255 1472

e: [email protected]

www.energyinst.org.uk

This publication has been produced as a result of

work carried out within the Technical Team of the

Energy Institute (EI), funded by the EI’s Technical

Partners. The EI’s Technical Work Programme

provides industry with cost effective, value adding

knowledge on key current and future issues

affecting those operating in the energy sector,

both in the UK and beyond.

Registered Charity Number 1097899

ISBN 978 0 85293 462 3


GUIDELINES FOR THE MANAGEMENT OFSAFETY CRITICAL ELEMENTS

Second edition

March 2007



GUIDELINES FOR THE MANAGEMENT OFSAFETY CRITICAL ELEMENTS

Second edition

March 2007

Published byENERGY INSTITUTE, LONDON

The Energy Institute is a professional membership body incorporated by Royal Charter 2003Registered charity number 1097899

Endorsed byThe United Kingdom Offshore Operators Association and the HSE Offshore Safety Division


The Energy Institute gratefully acknowledges the financial contributions towards the scientific andtechnical programme from the following companies:

BG GroupBHP Billiton LimitedBP Exploration Operating Co LtdBP Oil UK LtdChevronConocoPhillips LtdENIExxonMobil International LtdKuwait Petroleum International LtdMaersk Oil North Sea UK Limited

Murco Petroleum LtdNexenSaudi AramcoShell UK Oil Products LimitedShell U.K. Exploration and Production LtdStatoil (U.K.) LimitedTalisman Energy (UK) LtdTotal E&P UK plcTotal UK Limited

Copyright © 2007 by the Energy Institute, London:The Energy Institute is a professional membership body incorporated by Royal Charter 2003.Registered charity number 1097899, EnglandAll rights reserved

No part of this book may be reproduced by any means, or transmitted or translated into a machine language withoutthe written permission of the publisher.

The information contained in this publication is provided as guidance only and while every reasonable care has beentaken to ensure the accuracy of its contents, the Energy Institute cannot accept any responsibility for any action taken,or not taken, on the basis of this information. The Energy Institute shall not be liable to any person for any loss ordamage which may arise from the use of any of the information contained in any of its publications.

The above disclaimer is not intended to restrict or exclude liability for death or personal injury caused by ownnegligence.

ISBN 978 0 85293 462 3Published by the Energy Institute

Further copies can be obtained from Portland Customer Services, Commerce Way, Whitehall Industrial Estate, Colchester CO2 8HP, UK. Tel: +44 (0) 1206 796 351e: [email protected]

Electronic access to EI and IP publications is available via our website, www.energyinstpubs.org.uk. Documents can be purchased online as downloadable pdfs or on an annual subscription for single users andcompanies. For more information, contact the EI Publications Team. e: [email protected]


v

CONTENTS

Page

Foreword . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . vii

Acknowledgements . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . viii

1 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1

2 Background to the revision of Guidelines for the management of safety critical elements . . . . . . . . . . . 3

3 Applicable legislation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5

4 Definitions and key concepts . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 74.1 Safety critical elements . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 74.2 Major accidents . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 74.3 Performance standards . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 74.4 Verification schemes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 74.5 Independent competent persons . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7

5 Identification of SCEs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9

6 Development of Performance Standards . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13

7 Assurance of SCE integrity . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15

8 Verification throughout the asset life . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 178.1 Overview of verification . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 178.2 Verification in the concept, feed, design, construction and commissioning phases . . . . . . . . . . . . . . . 188.3 In-service verification . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 198.4 Decommissioning . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 20

9 Change management . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 219.1 Modifications . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 219.2 Temporary equipment . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 21

10 References and glossary of terms . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 23


vi


vii

FOREWORD

In 2005, the UKOOA led Installation Integrity Working Group (IIWG) requested that the Energy Institute managethe review and revision of the UKOOA Guidelines for the management of safety critical elements, first issued inSeptember 1996. This project required the formation of a separate (sub) Working Group from the parent IIWGmembers.

The revision exercise was part of a programme of work undertaken by the IIWG which included development andpromotion of industry good practices and suitable performance measures. A principal deliverable of this WorkingGroup was the Asset Integrity Tool Kit, which includes an Assurance and Verification Tool outlining therequirement for identification, assurance and verification of Performance Standards for Safety Critical Elements.These Guidelines are therefore considered as providing valuable input for this element of the management ofinstallation integrity.

It is intended that these Guidelines should provide good practice for the management of safety critical elements foroffshore installations and will be of use principally for those involved in assurance and verification. The documentshould also provide a useful guide for duty holders, managers of operations, safety, engineering and maintenancefunctions, and an initial introduction for those who wish to become involved in the subject.

This document has been compiled as guidance only and while every reasonable care has been taken to ensure theaccuracy and relevance of its contents, the Energy Institute, its sponsoring companies, the document writer and theWorking Group members listed in the Acknowledgements who have contributed to its preparation, cannot acceptany responsibility for any action taken, or not taken, on the basis of this information. The Energy Institute shall notbe liable to any person for any loss or damage which may arise from the use of any of the information contained inany of its publications.

These Guidelines will be reviewed in future and it would be of considerable assistance for any subsequent revisionif users would send comments or suggestions for improvements to:

The Technical Department,Energy Institute,61 New Cavandish Street,LondonW1G 7AR

e: [email protected]


viii

ACKNOWLEDGEMENTS

The Institute wishes to record its appreciation of the work carried out by the following individuals:

Tim Walsh of Lloyds Register EMEA, for the drafting of this document.

Members of the Joint Industry Working Group, which was set up to steer the re-drafting programme and who haveprovided valuable expertise:

Keith Hart Energy Institute (Manager and Chairman)Lee Broadley Talisman Energy LtdSimon Brown HSE OSDBernard Emery HSE OSDPeter Griffiths HSE OSDPaul Kefford ChevronBob Kyle UKOOAAlex Macleod Lloyds Register EMEABill McKenzie BP Operating Company LtdAlan Richardson HSE OSDIan Wright DNV

Assistance was also provided by:

Garry Mannett BVRichard McCabe BVPhil Rothie BVRuth White DNV

The Institute also wishes to recognise the contribution made by those who have provided comments on the Draftdocument which was issued during an industry consultation period.


1

1

INTRODUCTION

The purpose of this document is to provide industryguidance for the management of Safety CriticalElements (SCEs) on offshore installations operating onthe UK continental shelf. SCEs are the equipment andsystems which provide the basis to manage the risksassociated with Major Accident Hazards (MAHs). Thisdocument should be read in conjunction with theOffshore Installations (Safety Case) Guidelines. Thispublication replaces that of the same title produced bythe UK Offshore Operators Association (UKOOA) in1996.

The starting point for this guidance is a review ofthe applicable legislation and a summary of the keyconcepts underpinning the management of SCEs. The

document then describes the process by which SCEs areidentified and performance standards set. The process ofverification is central to ensuring that the integrity ofSCEs is maintained and guidance is provided for themanagement of verification throughout the variousstages of the asset lifecycle. The document also dealswith the management of change in relation to SCEs andconcludes by identifying sources of further informationincluding good practice and FAQs.

This document is aimed at all those who have aninterest and/or involvement in the management of SCEs,particularly those responsible for the management oftechnical and operational activities within, or on behalfof, duty holders.


GUIDELINES FOR THE MANAGEMENT OF SAFETY CRITICAL ELEMENTS

2


3

2

BACKGROUND TO THE REVISION OFGuidelines for the management of safety

critical elementsThe first issue of the joint industry Guidelines for themanagement of safety critical elements was produced bya UKOOA led work group in September 1996, at a timewhen the new "verification regime" was beingintroduced. That document was primarily intended toprovide guidance to the industry on how the newrequirements should be implemented on installationsthat had been designed, constructed and operated underthe previous "certificate of fitness" requirements.

The UK oil and gas industry has been operating inaccordance with the requirements of the Offshore SafetyCase Regulations (OSCR) since 1996 and it isappropriate that the original guidelines should berevised to take account of experience gained in recentyears. Since the publication of the original guidelines,there have also been additional developments fromwithin industry which have impacted on themanagement of safety critical elements and for whichguidance is provided in this document.

These include:

— Major modifications being carried out to existinginstallations as they are developed for changingfield characteristics and functions, which may bevery different to those for which they wereoriginally designed.

— Replacement of verification aspects of the OffshoreInstallations (Design & Construction) Regulations(1996) by the Offshore Safety Case Regulations(2005).

— Installations that are being operated well beyondtheir original design life.

— Changing ownership, and in some cases, multiplechanges of ownership, of many older assets and theprevalence of smaller independent operators, someof whom are new entrants to the UK sector.

— The increasing importance of decommissioningactivities.



4


5

3

APPLICABLE LEGISLATION

The requirement for industry to manage SCEs iscovered either directly or indirectly by the followingregulations:

— The Offshore Installations (Safety Case)Regulations 2005.

— The Offshore Installations (Prevention of Fire andExplosion and Emergency Response) Regulations1995 (PFEER).

The following table shows how these regulations relateto the management of SCEs.

Regulations Section Areas covered

OSCR 2005 Regulation 2 Definition of Safety Critical Elements

Definition of Major Accident Hazards

Assurance of the fitness for purpose of SCEs

Independent Competent Persons

Regulation 19 Duty holders’ responsibility with respect to theidentification and management of SCEs

Schedule 7 Matters to be provided for in a verification scheme

PFEER 1995 Regulation 5 Performance Standards

Regulation 19 Assurance of the fitness for purpose of SCEs



6


7

4

DEFINITIONS AND KEY CONCEPTS

There are a number of definitions and key conceptswhich are essential to the successful management ofSCEs. Details of these are provided within theregulations, approved codes of practice and guidancedocuments; however the main concepts are summarisedbelow.

4.1 SAFETY CRITICAL ELEMENTS

Safety Critical Elements are any part of the installation,plant or computer programmes whose failure will eithercause or contribute to a major accident, or the purposeof which is to prevent or limit the effect of a majoraccident, and for the purpose of these guidelines,include items of specified plant referenced inRegulation 19 of PFEER.

4.2 MAJOR ACCIDENTS

Major accidents are fires, explosions or releases ofdangerous substances that will cause death or seriousinjury; major damage to the structure or plant or loss ofstability; the collision of a helicopter; failure of lifesupport systems for diving operations; or any otherevent involving death or serious injury to five or morepeople.

4.3 PERFORMANCE STANDARDS

A Performance Standard is a qualitative or quantitativestatement of the performance required of a system oritem of equipment in order for it to satisfactorily fulfil

its purpose.It is a requirement that Performance Standards

should be established for all SCEs.

4.4 VERIFICATION SCHEMES

Verification schemes are written schemes implementedto confirm, or otherwise, that SCEs are suitable andremain in good repair and condition. As from April2006 verification schemes should also cover specifiedplant required by PFEER and previously subject toPFEER written schemes of examination.

4.5 INDEPENDENT COMPETENT PERSONS

Independent Competent Persons (ICPs) are required tocarry out various functions under the verificationscheme to ensure that the process of managing risksassociated with the Major Accident Hazards is workingeffectively. It is a requirement that ICPs must besufficiently independent so as to be impartial andobjective in their judgement such that safety is notcompromised. The role of the ICP can either beundertaken by a single organisation or by a number ofdifferent individuals or organisations consideringseparate aspects of the installation. In the latter casehowever, greater co-ordination will be required by theduty holder to ensure that all parts of the scheme havebeen adequately addressed and that interfaces areeffectively managed. Although not mandatory, it isgenerally recommended that where multiple ICPs areemployed, one has an overseeing role.



8


9

5

IDENTIFICATION OF SCEs

Although there are various different, and equallyacceptable, ways of identifying SCEs there are steps

which are common to all. These common steps areshown in Figure 5.1 and described below.

Figure 5.1: Identification of SCEs

Identify Major Accidentevents using the

Safety Case

Identify structure and plant which can cause, prevent,detect, control, mitigate, rescue or help recover from a

major accident

Record items identifiedas SCEs

Identify PFEER specified plant



10

Step 1: Identify the major accident events on theinstallation

This is carried out using a series of hazard identificationtechniques, involving both qualitative and quantitativemethods. The results from this process are generallyrecorded in a Hazard Register which documents all ofthe potential major accident event scenarios on aninstallation, and should be documented in the safetycase for the installation.

Step 2: Identification of structures and plant whichcan cause, contribute to, prevent or helprecover from a major accident

Duty holders will generally utilise lists of plant andequipment, extracted from their computerisedmaintenance management systems, as the starting pointfor assessing which of the items on the list are safetycritical. The issue of 'how deep to dig' is one thatrequires to be addressed before the identificationprocess can begin. Approaches vary, but SCEs need tobe defined at an appropriate level such that they have adirect linkage to MAHs, and it is also clear whether ornot an equipment item forms part of one or more SCEs.

A team approach to SCE selection is usual as it isunlikely that a single person would have sufficienttechnical appreciation of the major accident analysesand detailed knowledge of the installation. Starting fromthe complete list of equipment the team should assesseach item in turn and form a view as to whether it couldcause, contribute to, prevent or help recover from, amajor accident.

The outcome of these deliberations should berecorded giving the reasons why an item has, or has notbeen identified as safety critical and with reference tothe relevant major accident hazard.

Step 3: Identify PFEER Specified Plant

Specified Plant is any of the plant of an installationwhich is provided:

— To comply with Regulations 11(1)(a), 13, 15 and16 of the PFEER Regulations.

— As a means of detecting fire and for detecting andrecording accumulations of flammable gases (asrequired by Regulation 10 of the PFEERRegulations).

— Measures to combat fire and explosion as requiredby Regulation 12 of the PFEER Regulations.

Step 4: Prepare a record of items identified asSafety Critical Elements

It is important that the record of SCEs is maintained upto date, therefore the major accident analyses and thelist of SCEs should be reviewed periodically. The listshould also be reviewed prior to the addition of newequipment or modification of existing plant.

A typical (but non-exhaustive) example, showingthe interrelationship between MAHs and SCEs is givenbelow.


IDENTIFICATION OF SCEs

11

HAZARDIDENTIFICATION

AND ASSESSMENT

PRIMARYMAJOR

HAZARDS

SAFETY CRITICAL ELEMENTS AND SUB-ELEMENTS

PROCESSCONTAINMENT

IGNITIONCONTROL

SAFEGUARDINGSYSTEMS

FIREPROTECTION

NAVIGATIONALAIDS

STRUCTURES

LIFTINGEQUIPMENT

ROTATINGEQUIPMENT

COMMUNICATIONSEQUIPMENT

ESCAPE, EVACUATION AND

RESCUE EQUIPMENT

PRESSURE VESSELSPIPING

PIPELINESWELLS

Ex CERTIFIED EQUIP.ELECTRICAL TRIPPING EQUIP.EARTHING AND BONDING EQUIP.

PROCESS SHUTDOWN SYSTEMEMERGENCY SHUTDOWN SYSTEM

FIRE AND GAS SYSTEM

WATER FIRE FIGHTINGCHEMICAL FIRE FIGHTINGPASSIVE FIRE PROTECTION

AIRCRAFTSEACRAFT

SUPPORT STRUCTURESFACILITY STRUCTURES

EXPLOSION PROTECTION

CRANESLIFTING GEAR AND BEAMS

TURBINE P.M. FOR COMPRESSORSTURBINE P.M. FOR GENERATORS

RADIOSTELEPHONES

PUBLIC ADDRESS

LIFEBOATSLIFERAFTS

HELICOPTER RESCUE BOXPERSONAL SAFETY EQUIPMENT

MAJORACCIDENTSCENARIOS

MAJORACCIDENTHAZARDS

MAJORHAZARDSREGISTER

TURBINEDISC

FAILURE

DROPPEDOBJECTS

STRUCTURALFAILURE

SHIPCOLLISION

HELICOPTERCRASH

EXPLOSION

FIRE

MAI

NTE

NAN

CE M

ANAG

EMEN

T SY

STEM

FLOW



12


13

6

DEVELOPMENT OF PERFORMANCESTANDARDS

This activity follows from the identification of MAHsand selection of SCEs described in Section 5.

The creation of Performance Standards (PSs) is theprocess by which a duty holder sets out what isexpected of an SCE. The PSs are the criteria againstwhich the initial and ongoing suitability of an SCE isassessed. Safety Integrity Level (SIL) assessments maybe used to develop PSs for instrument based protectivesystems.

Performance Standards for SCEs are generallydefined in terms of:

— Functionality – What is it required to do?— Availability – For what proportion of time will it be

capable of performing?— Reliability – How likely is it to perform on

demand?— Survivability – Does it have a role to perform post

event?— Interactions – Do other systems require to be

functional for it to operate?



14


15

7

ASSURANCE OF SCE INTEGRITY

It is the responsibility of the duty holder to ensure thatSCEs are able to perform their intended functions withthe required availability and reliability throughout theirservice.

This should be achieved by the following means:

1. Identifying those assurance activities, such asmaintenance, inspection and testing, that arerequired to maintain the SCE in a suitablecondition.

2. Ensuring that assurance activities are carried out atthe appropriate time by competent people.

3. Maintaining a record of these activities and anyfindings that arise.

4. Addressing any deficiencies arising from assuranceactivities as soon as possible and taking anytemporary measures that may be necessary tomaintain risk ALARP until deficiencies have beenrectified. Any temporary measures should besubject to review and comment by the ICP.



16


17

8

VERIFICATION THROUGHOUT THEASSET LIFE

8.1 OVERVIEW OF VERIFICATION

This section provides an overview of verification anddescription of how verification should be approachedduring the various stages of the asset’s life.

8.1.1 Elements of a verification scheme

A verification scheme must address the following (seeOSCR (2005) Schedule 7):

1. The principles to be used in selecting persons toperform functions under the scheme and keep itunder review (i.e. the ICP).

2. Arrangements for communicating necessaryinformation to persons performing functions underthe scheme and reviewing it.

3. The nature and frequency of examination andtesting.

4. Arrangements for reviewing and revising thescheme.

5. Arrangements for record keeping for examinationsand tests carried out, results and findings,recommended actions and close-out ofrecommended actions.

6. Arrangements for communicating 5. to theappropriate level in the duty holder’s organisation.

8.1.2 Responsibilities of the ICP

The ICP is required to review and comment on the listof SCEs and ensure himself that Performance Standardsare appropriate; any reservation raised by the ICPshould be recorded.

The verification scheme may be drawn up by eitherthe duty holder (or an appointee acting on its behalf), orthe duty holder in conjunction with the ICP. If it is notdrawn up by the ICP, then the ICP must review andcomment on the scheme and a record of that review(including any comments or reservations as a result ofunresolved issues arising) should be retained as part ofthe scheme records.

The ICP is responsible for carrying out theverification activities detailed in the verificationscheme. The duty holder is responsible for ensuring thatthe ICP is provided with all access necessary andinformation required to carry out the verificationactivities.

8.1.3 Verification activities

Verification activities are those carried out by the ICPand are intended to either directly establish thesuitability of the SCE, or to establish that appropriateassurance activities have been undertaken (e.g. thewitnessing of emergency shutdown system functiontests).

Both assurance and verification activities should bedefined in the same written scheme of examination, butonly an ICP can carry out verification activities.



18

The verification scheme should provide a clearindication of the nature and frequency of the verificationactivity that the ICP is expected to carry out.

When assurance and maintenance work is carriedout sufficient information should be recorded to showthat the SCE remains in good repair and condition. Thisis particularly important where availability andreliability performance standards require to bedemonstrable.

8.2 VERIFICATION IN THE CONCEPT, FEED,DESIGN, CONSTRUCTION AND

COMMISSIONING PHASES

During these initial phases of a development project, theduty holder is required to demonstrate “initialsuitability” of SCEs through the following:

— Consideration of the design.— Confirmation of the adequacy of manufacture,

fabrication and installation.— Demonstration during commissioning that the

SCEs are capable of meeting the requiredperformance standards.

The ICP’s role is to carry out independent examinationof documents, activities and plant and equipment toconfirm the level of compliance with the performancestandards.

The identification of SCEs and the setting ofperformance standards are important activities duringthese pre-operating stages of the project as they providethe foundation for managing the MAH risk.

Development of a verification scheme for newconstruction requires input and co-ordination from anumber of different parties within the duty holder’sorganisation, and also from the ICP, design contractors,fabricators and completions team. The earlyengagement of all parties in the process is crucial to asuccessful outcome. Particular effort should be made toensure that previous operational experience is utilisedduring the detailed design and construction phases.

8.2.1 Major Accident Hazards and SCEs

It is usual to produce a document (MAH / SCE matrix)listing the SCEs and describing their derivation linkageto the MAH (See section 5). Where changes to processplant and equipment are undertaken, a similar documentshould be produced identifying the impact on theexisting SCEs of each modification and identifying anynew SCEs resulting from the changes to MAHs (seeSection 9.1).

8.2.2 Performance Standards for SCEs

Once SCEs have been identified, PerformanceStandards (PSs) need to be set for each (see Section 6).

Those PSs associated with establishing “initialsuitability” may be different to those used to assessongoing suitability throughout the operational life of theSCE. There are a number of ways of dealing with thisissue including the development of separate PSs forinitial and ongoing assessment and the incorporation ofboth into a single PS. Regardless of the approach taken,it is essential that the requirement contained in the PSassures that the SCE can fulfil its function. The PS mustalso be written in such a way that it can be clearlyestablished whether or not the required standard ofperformance has been achieved.

8.2.3 Documenting the scheme

There is no fixed way of documenting a newconstruction verification scheme and a number ofmethods have been employed ranging from having alldetails and records in a single document to having anumber of separate documents dealing with differentrequirements. In the later case, an overall document willbe necessary in order to describe how the various piecesof documentation relate to each other. Whicheverapproach is taken, it should ensure that all the detailsrequired by Schedule 7 of OSCR are provided (seesection 8.1).

8.2.4 Execution

During the design and construction phase the followingissues need to be considered in executing theverification scheme:

— Identification of design deliverables forverification.

— Timing of verification submissions for design. — Scope of procurement/fabrication verification

activities.— Scope of verification activities during Hook up

Installation and Commissioning (HUIC).— Verification during start-up activities.— Close-out of Construction (Project) Verification

Scope.

(i) Identification of design deliverables forverification

It is important that the design deliverables that aresubject to review by the ICP are clearly defined andagreed as early as possible in the life of the project. This


VERIFICATION THROUGHOUT THE ASSET LIFE

19

process is usually facilitated by a mark-up of the projectMaster Document Register (MDR).

Sufficient records should be maintained by the ICPto ensure that the documentation subject to review foreach SCE is clearly identified and that its status,together with any associated ICP comment, can bereadily established at any time during the process. Theduty holder may elect to maintain these records himself.

A clear system should be established by the projectto alert the ICP to changes to design documentationalready examined which could affect the determinationof suitability. This will help to avoid any necessity forexamination of successive revisions of documentationin the future. The system should be subject to ICP auditand included as part of the overall verification scheme.

(ii) Timing of verification submissions for design Where possible, design documentation should bedivided into logical packages per SCE in consultationwith the ICP and a schedule for submission/examinationestablished. This will allow the most effective use ofresources on behalf of the ICP and enable the progressof the scheme, with regard to the different SCEs, to beeasily established.

It is particularly important that the ICP be given theopportunity to review and comment on the design earlyenough to be in a position to influence any changesnecessary to ensure suitability. (iii) Scope of procurement/fabrication verification

activitiesAs early as possible within the FEED and detaileddesign stages, a procurement register should be madeavailable to the ICP and agreement reached as to thoseitems which are to be subject to verification at source(i.e. at a vendor’s works).

The extent of verification activities proposed willbe agreed between the ICP and duty holder and shouldrelate to the risk associated with failure of each of theitem(s) concerned.

Verification activities at vendors’ works or at majorfabrication sites, should be documented by the issue ofspecific instructions to ICP surveyors complemented bya mark-up of the vendor/fabricator’s planned inspectionand test schedules to indicate those points whereintervention is required.

(iv) Scope of verification activities during HUICPrior to commencement of commissioning activities(either onshore or offshore) the commissioning plans forSCE systems should be made available for ICP review,comment and mark-up, to indicate those activitiessubject to verification review and the extent of ICPinvolvement. The nature and frequency of these

activities should again, be related to the risk of failure ofthe SCE to perform and should be agreed between theICP and duty tolder.

Verification activities during commissioning shouldbe supported by the issue of specific instructions to ICPsurveyors.

(v) Verification during start-up activitiesThe project should produce a specific start-up plan forbringing the new or modified facilities into use. Thepurpose of this is to allow the duty holder to manage thechanging MAH and risk profile during this phase of theproject. This should be reviewed by the ICP andagreement reached with the duty holder with regard toa schedule for finally establishing suitability for eachSCE. Dependent on the situation, some SCEs willrequire to be fully functional (and verified) sooner thanothers and equally, “Partial” SCEs are likely to berequired at some stages.

A formal documented process should be establishedwhich allows the duty holder to assess the status ofassurance and verification at each stage of the start-upprocess.

(vi) Close-out of Construction (Project) VerificationScope

At the end of the project, and as part of the handover tooperations, the conclusions of the project verificationscheme should be documented and agreed.

These will include:

— The results of the ICP scrutiny of the list of SCEsand the verification scheme itself.

— A completed matrix relating examinationsundertaken to particular SCEs.

— Completed and signed off ICP work instructionsissued at each stage.

— A statement of any conditions or reservationsexpressed by the ICP during the course of theexaminations.

— A final statement as to the suitability of theidentified SCEs.

8.3 IN-SERVICE VERIFICATION

Verification of the ongoing suitability of SCEs onoffshore installations begins once they are in operation.An in-service verification scheme should be preparedduring the construction phase and all interested partiesmade familiar with it before the installation is taken intooperation. Those interested parties include:

— Duty holder’s verification engineer/coordinator.



20

— Technical Authorities within the duty holder andengineering support organisations.

— Representatives from the duty holder’s SafetyEngineering department.

— Relevant ICPs.

8.3.1 Units entering the UKCS

In the case of an existing installation being taken intouse on the UKCS for the first time, a safety case shouldbe developed and an associated verification schemeshould be set in place in preparation for the beginningof the operating period. It will be necessary for such ascheme to address the 'initial' as well as the 'ongoing'suitability of the identified SCEs.

8.3.2 Scheme revision

Verification schemes should be kept under continuousreview and revised as often as is necessary to keep themup to date. In addition to periodic reviews a schemereview should be initiated by changes such as thefollowing:

— Revision of any Codes or Standards referenced inthe scheme.

— Modifications to the installation which result inamendments to the list of SCEs.

— Significant revision to the installation Safety Case.— Changes to installation operating parameters.— Changes to environmental conditions.

8.3.3 Reporting

Reports of verification surveys undertaken by ICPseither onshore or offshore should be presented to theduty holder’s nominated representative in a timelymanner. Each report should provide the duty holderwith a clear representation of the condition of the SCEand confirmation or otherwise, that the PS has beenfully addressed. It is not sufficient to report 'byexception' as this does not present a full picture of thecondition of the SCEs.

8.3.4 ICP Recommendations

In instances where a compromised SCE is identified orwhere a PS is inadequately addressed during theverification process, the ICP report should contain aclear statement regarding 'continuing suitability' and arecommendation as to the course of action which shouldbe adopted by the duty holder.

The verification scheme should contain targets forinitial response times and final close-out times for ICPrecommendations.

It is the duty holder’s responsibility to address anyrecommendation made by the ICP in order to restore theaffected SCE to the capability stipulated by the PS, inthe most expedient manner.

8.4 DECOMMISSIONING

8.4.1 Review of MAHs.

At least three months prior to decommissioning takingplace, the duty holder should prepare revisions to theinstallation safety case and these should be assessed forany impact on the list of SCEs. These changes wouldresult from:

— A hydrocarbon free environment.— Hazard identification primarily focussed on heavy

construction, lifting and marine operations.— Residual hazards after the decommissioning:

- navigational/marine traffic; - environmental/pollution;- seabed/fishing gear.

The amended SCE list will be significantly differentfrom the operational case and PSs should be revised orrewritten and a decommissioning verification schemeproduced that will confirm ongoing suitability of SCEsduring key stages of the decommissioning.


21

9

CHANGE MANAGEMENT

9.1 MODIFICATIONS

9.1.1 Importance of duty holders’ Managementof Change systems

Duty holders should have a documented and effectiveprocess for the management of change andmodifications to platform systems, components orstructures. Responsibility and/or accountability ofindividuals within the duty holder’s organisation for thevarious functions within the change process should beclearly defined. Changes directly affecting SCEs orimpacting on SCE functions in managing risk shouldprovide for update of any formal risk assessments whereappropriate. The process should make explicit referenceto the involvement of the ICP in all modifications whichimpact upon existing SCEs or the creatation of newones. The 'management of change' document should becontrolled by the duty holder and referenced in the dutyholder’s verification scheme.

9.1.2 Need for SCE Impact study

During the assessment of individual modifications, it isimportant to have a thorough understanding of theoriginal MAH identification and the philosophies forprevention, mitigation and control. All modificationsshould be assessed to establish their impact on theexisting list of SCEs or if they create additional SCEs.For those modifications which are confirmed to havesafety critical content, the following aspects need to beconsidered:

— Identification of new SCEs.— Reassessment of existing Performance Standards

and the need for new Performance Standards fornew SCEs.

— Need to clearly document project verificationactivities for "initial suitability".

— Incorporation of changes and modifications intoongoing operational verification (and maintenance)regimes with any proposed revisions to SCEmaintenance regimes being reviewed by the ICP.

— Involvement of operations and the "Operational"ICP in project scope.

9.2 TEMPORARY EQUIPMENT

9.2.1 Temporary equipment impact on SCEs

Duty holders should have a documented process inplace to demonstrate their intention and ability tomanage the transportation and use of temporaryequipment and in particular, equipment which adds to orimpacts upon the list of SCEs. This process should bereferenced in the Verification Scheme for eachinstallation. 9.2.2 Performance Standards for temporary

equipment

Performance Standards should be established for itemsof temporary equipment in all cases where the existingPS applicable to the installation is either inadequate orinappropriate.



22

9.2.3 Assurance and verification activities fortemporary equipment

Temporary or portable equipment for use on an offshoreinstallation should be subject to appropriate assuranceand verification activities if:

— The equipment in itself creates an addition to theplatform list of SCEs (e.g. demountable drillingequipment not permanently held on theinstallation).

— The equipment impacts on any of the existingplatform SCEs:- by virtue of the planned location on the

installation (e.g. engine driven generator/compressor required to operate in a designatedhazardous area);

- by virtue of the proposed application (e.g. wellintervention equipment once it becomes part ofthe reservoir pressure envelope).

The installation verification scheme should identify thenature and frequency of assurance and verificationactivities associated with temporary equipment; theseshould include:

— Examination of equipment prior to shipment.— Witnessing of testing prior to shipment.— Review of manufacturers’ / suppliers’ records /

certification.— Examination of equipment offshore.— Auditing of the management processes and records

held:- by the duty holder onshore and offshore;- by the Shipping/Forwarding contractor.

Comprehensive records should be maintained by theduty holder to confirm adherence to the process. Theserecords should be available to the ICP.


23

10

REFERENCES ANDGLOSSARY OF TERMS

10.1 REFERENCES OF FURTHERINFORMATION

List of references and further information sources fromHSE, UKOOA and EI:

— A Guide to the Offshore Installations (Safety Case)Regulations 2005 (HSE, 2006)

— Prevention of Fire and Explosion and EmergencyResponse on Offshore Installations – ApprovedCode of Practice and Guidance (HSE, 1997)

— Asset Integrity Toolkit (UKOOA, 2006)

10.2 GLOSSARY OF TERMS

FEED Front End Engineering DesignHUIC Hook Up, Installation and CommissioningICPs Independent Competent PersonsMAHs Major Accident HazardsMDR Master Document RegisterOSCR Offshore Safety Case RegulationsPFEER Prevention of Fire and Explosion and

Emergency Response RegulationsPSs Performance StandardsSCEs Safety Critical ElementsUKOOA UK Offshore Operators Association



24

Date post:	10-Oct-2014
Category:	Documents
Upload:	zseyo1
View:	2,695 times
Download:	46 times