NEBOSH International Technical Certificate in Oil and Gas Operational Safety

2 Hydrocarbon process safety 1

Learning outcomes 2.1 Explain the principles of assessing and managing contractors, including the roles of parties involved 2.2 Outline the tools, standards, measurement, competency requirements and controls applicable to Process Safety Management (PSM) in the oil and gas industries 2.3 Explain the role and purpose of a permit-to-work system 2.4 Explain the key principles of safe shift handover 2.5 Explain the importance of safe plant operation and maintenance of hydrocarbon containing equipment and processes 2.6 Outline the hazards, risks and controls to ensure safe start up and shut down of hydrocarbon containing equipment and processes It is important from the offset to explain the purpose of this course. It is designed to enable managers to transfer their skills to the identification of hazards in the workplace and to determine the effectiveness of the controls in place. The course provides an overview of the reasons why safety should be managed as an equal partner to the other duties managers may have and as such it should be an integral part of their day to day work. The course will confirm some existing delegates understanding and may well provide additional skills to enable them to manage risks better in their workplace, but it is essentially an awareness course and will not make them experts in the topics covered and as such they will need to take expert on advice on specifics where they have uncertainty in the future. Emphasise that the delegates should take an active part throughout the course and share experiences freely to get the best out of the course. Finally the materials contain key learning points; reassure them that this is all they will need for the final written assessment; an example of this will follow shortly in the powerpoint. The core materials may be particularly useful when producing their workplace assignment, the second part of the assessment process, which will be discussed later in the course.

Content 2.1 Contractor management 2.2 Process safety management (PSM) 2.3 Role and purpose of a permit-to-work system 2.4 Key principles of safe shift handover 2.5 Plant operations and maintenance 2.6 Start up and shut down 4

Introduction A contractor is anyone who is called into work for your company but is not an employee Many accidents involve contractors working on a site due to a number of factors: - Activities can be risky due to the type of work - Poor communication - Unfamiliar with the site - Poor selection processes, training and competency

Scale of contractor use Many companies turn to contractors to supplement their engineering staff They are also used for specialist tasks, often involving hazardous activities This could involve working on critical process plant and equipment or carrying out non-routine activities It is important to ensure that contractors are properly briefed on and understand, the major hazard risks associated with the activities It is often a legal requirement

Contractor management, ownership and representation There are five basic steps involved in managing contractors: Step 1: Planning Step 2: Choosing a contractor Step 3: Contractors working on site Step 4: Keeping a check Step 5: Reviewing the work

Content 2.2 Process safety management (PSM) 2.1 Contractor management 2.2 Process safety management (PSM) 2.3 Role and purpose of a permit-to-work system 2.4 Key principles of safe shift handover 2.5 Plant operations and maintenance 2.6 Start up and shut down 8

Introduction PSM involves managing a number of technical, managerial and human factors activities which, if not managed effectively, may lead to a major incident High profile incidents such as Buncefield have highlighted the need for high risk installations to have effective systems in place to prevent, or limit the effects of, such incidents

The OSHA process safety management standard Employee participation Process safety information (PSI) Process hazards analysis (PHA) Operating procedures Training Contractors Pre-startup safety review (PSSR) Mechanical integrity Hot work permits

The OSHA process safety management standard Management of change (MOC) Incident investigation Emergency planning and response Compliance audits Trade secrets The spacing of operating plant Control rooms, temporary refuge and critical associated safety systems

Management of change controls The failure to manage change has been a critical factor in several major accident incident scenarios The destruction of the Nypro UK site (1974) at Flixborough, was a prime example of a lack of effective management of change

Management of change controls Risk assessment and authorisation The UK Chemical Industries Association Safety Advisory Group outlines the following good practice related to plant modification/change procedures: - Members of staff must be aware of the hazards associated with the work they carry out - Risk assessment must be carried out to determine the possibility and consequence of the hazards being realised - All modifications should be subject to formal management procedures

Management of change controls Risk assessment and authorisation Good industry practice requires that process and plant modifications should not be undertaken without having undertaken a safety, engineering and technical review This review should be traceable and identify changes proposed to the following factors: process conditions; operating methods; engineering methods; safety; environmental conditions; engineering hardware and design

Content 2.2 Process safety management (PSM) 2.1 Contractor management 2.2 Process safety management (PSM) 2.3 Role and purpose of a permit-to-work system 2.4 Key principles of safe shift handover 2.5 Plant operations and maintenance 2.6 Start up and shut down 15

Introduction An integral part of a safe system of work A permit-to-work system is a formal, recorded process used to control work which is identified as potentially hazardous Such work is generally “non-routine and high risk” A permit-to-work system should ensure that authorised and competent people have thought about foreseeable risks and that such risk are avoided by using suitable precautions

The key features of a permit-to-work system A permit-to-work system should be fully documented, and include: - How the system works - The jobs it is to be used for - The responsibilities and training of those involved - The arrangements for checking its operation

The key features of a permit-to-work system Essential features of permit-to-work systems are: - Clear identification of the tasks requiring a permit to work - Responsibilities of issuing/authorising and recipient/performing authorities (and any limits to their authority) - Training requirements for the authorising and performing authorities - Details of monitoring and auditing requirements to ensure that the system works as intended

The key features of a permit-to-work system An effective permit-to-work form should: - Clearly describe the task to be performed - Indicate the date/location/equipment to be worked on - Identify the permit validity time - Identify any isolations that may be required - Identify any residual hazards - Cross reference any other activities or isolations - Make provision for permit extensions - Incorporate provision for permit hand back and cancellation

Interfaces with adjacent plant Important to make sure that one activity under a permit-to-work does not create danger for another Those involved with the issue of permits-to-work should be aware of potential interaction Ensure that when a permit is prepared, the work to be carried out takes account of the other activity currently planned or underway It may be that the interacting activities are covered by separate responsible authorities therefore close liaison will be necessary

Interfaces with contractors The client company is responsible for operational health and safety Irrespective of where its resources come from i.e. its own staff, contract, subcontract or agency staff or self-employed workers The client should ensure that contractors: - Understand the permit-to-work systems and particular locations at which they or their employees are to work - Are properly trained

Interfaces with contractors Types of permit (used for the following activities): Hot work Work on electrical systems Work on machinery Excavation work Work over water Diving work Confined space entry work Work with ionising radiation Work with asbestos

Interfaces with contractors There are typically 3 copies of a permit to work issued: One to be kept at the work site, or with the performing authority A copy to be kept on display in the control room A copy to be kept with the Issuing authority

Interfaces with contractors Electronic permits Permits can be produced electronically and a number of companies are using this type of system There may be advantages in reducing the amount of paperwork associated with the permit process

Lock out, tag out and isolation procedures Lock out, tag out often known as LOTO in the oil and gas sectors is a safety procedure It ensures that any piece of equipment being worked on cannot be inadvertently powered up or started in any way while workers are repairing it LOTO involves the isolation of all energy sources A means of ensuring inadvertent re-energisation; and an adequate means of warning (usually in the form of a tag or label)

Lock out, tag out and isolation procedures LOTO is concerned with the isolation of all types of energy source, including: - Electrical supplies - Pneumatics - Hydraulics - Steam

Lock out, tag out and isolation procedures Ensuring safe isolation, lock out and tag out Isolation steps can be summarized as follows: Shutdown the machinery or equipment to be worked upon Isolate the equipment from its energy source Dissipate any stored energy Lockout and tag out the energy isolating devices with assigned locks and tags Confirm that the isolation is effective

Lock out, tag out and isolation procedures Ensuring safe isolation, lock out and tag out Removing locks and tags Before returning the equipment to service; checks should be made to ensure that all tools, spare parts, etc have been removed Ensure that all safety guards are in place, that all workers are notified and clear of the equipment Only then should the locks be removed, power restored and checks to confirm that the equipment is functioning correctly

Lock out, tag out and isolation procedures Ensuring safe isolation, lock out and tag out Removing locks and tags It is important to remember that only the person locking equipment out has the key to unlock it If that person is not available (perhaps because of a shift change), for an oil rig, the key should be left with the Rig Manager and the relief supervisor and the relieving driller notified of the work that is being performed No equipment should be unlocked without these basic procedures being followed

Lock out, tag out and isolation procedures Forms of mechanical isolation Valves The simplest form of isolation device, standard use for process plant and pipelines suitable for all fluids at all pressure ranges Valves may not give tight shut-off due to seal damage, and require locking off to prevent inadvertent operation

Lock out, tag out and isolation procedures Forms of mechanical isolation Valves Locking-out equipment is not always a straight-forward procedure and at times requires careful analysis and consideration

Lock out, tag out and isolation procedures Spades and spectacle plates A solid plate inserted between flanges, standard use for process plant and pipelines Suitable for all fluids over a range of pressure ratings

Lock out, tag out and isolation procedures Specialist isolation techniques Squeeze off Foam bagging Pipe stoppers Pipe plugs Inflatable bags Pipe freezing Hot tapping and stopping Pigs

Lock out, tag out and isolation procedures Pipe line plug

Lock out, tag out and isolation procedures Pipe line freezing

Content 2.2 Process safety management (PSM) 2.1 Contractor management 2.2 Process safety management (PSM) 2.3 Role and purpose of a permit-to-work system 2.4 Key principles of safe shift handover 2.5 Plant operations and maintenance 2.6 Start up and shut down 36

Introduction Effective communication is important in all organisations Oil and Gas exploration and production are continuous 24-hour operations Personnel typically reside on the offshore installation for 2-4 week periods, working alternating 12-hour shifts Poor communications and handover have been a factor in many major accidents (for example, Piper Alpha) The objective of handover is the accurate reliable communication of task-relevant information across shift changes or between teams

Introduction Effective handover consists of three elements: 1) A period of preparation by out-going personnel 2) Handover where out-going and in-coming personnel communicate to exchange task-relevant information 3) Cross-checking of information by in-coming personnel as they assume responsibility for the task

Shift handover The Cullen Report concluded that one of the many factors which contributed to the Piper Alpha disaster was failure of transmission of information at shift handover Knowledge that a pressure safety valve had been removed and replaced by a blind flange was not communicated between shifts Clarification of issues not adequately recorded or communicated at shift handover is therefore potentially problematic

Two-way with both participants taking joint responsibility Give effective shift handover communication a high priority Pay particular attention to handovers which occur when staff have returned following a lengthy absence from work Specify key information needed by the incoming operator to update their mental model of plant status Use operator support (logs, displays etc) Include communication skills in their selection criteria for shift-workers Develop the communication skills of existing staff

Key principles in handover Ensure that the incoming shift is aware of any outstanding permit-controlled jobs, the status of those jobs, and the status of the plant Work-in-progress should be left in a condition that can be reliably communicated to, and understood by, the oncoming shift A permit log, permit file or display boards are ways of recording on-going permits It is essential that there is good communication between incoming and outgoing issuing and performing authorities It is recommended that the incoming issuing authority signs to allow the continuation of a permit

Key principles in handover Formal handover check sheet Key communication of operational plant status should not rely solely on the memory of the parties involved in the handover process For example, the outgoing person to recall plant ‘status information’ or the incoming person ‘to ask specific questions’ A check sheet should be used at handover and the completed sheet should be retained to evidence that a structured handover procedure has been carried out

Content 2.2 Process safety management (PSM) 2.1 Contractor management 2.2 Process safety management (PSM) 2.3 Role and purpose of a permit-to-work system 2.4 Key principles of safe shift handover 2.5 Plant operations and maintenance 2.6 Start up and shut down 43

Asset integrity Asset Integrity can be defined as the ability of an asset to perform its required function effectively and efficiently whilst protecting health, safety and the environment Asset integrity management is the means of ensuring that the people, systems, processes and resources that deliver integrity are in place, in use and will perform when required over the whole lifecycle of the asset Essential for the integrity of any installation are the safety-critical elements (SCEs)

Asset integrity Barriers The SCEs represent the barriers which prevent, control or mitigate the major accident scenarios In the Swiss Cheese Model (see next slide), an organisation's defences against failure are modelled as a series of barriers, represented as slices of swiss cheese The holes in the cheese slices represent individual weaknesses in individual parts of the system, and are continually varying in size and position in all slices

Asset integrity Swiss cheese model

Maintenance, inspection and testing Factors that may help to determine the frequency and nature of maintenance includes: - The manufacturer's recommendations - The intensity of use - Operating environment - The risk to health and safety from any foreseeable failure or malfunction

Maintenance, inspection and testing Maintenance strategies Corrective - Refers to action only taken when a system or component failure has occurred Preventive - Equipment is repaired and serviced before failures occur

Maintenance, inspection and testing Maintenance strategies Predictive - Refers to maintenance based on the actual condition of a component Reliability centred maintenance - RCM involves the establishment or improvement of a maintenance program in the most cost-effective and technically feasible manner

Maintenance, inspection and testing Factors influencing inspection frequency include: - Where required by national regulations - After damage, major modification or repair - Equipment operating in extreme weather or harsh environments

Maintenance, inspection and testing Required to ensure that SCE continues to meet the required performance standard Functionality testing may be required following maintenance Testing of certain equipment may be required under national regulations

Maintenance, inspection and testing Corrosion prevention Corrosion is the deterioration of materials by chemical interaction with their environment The term corrosion is sometimes also applied to the degradation of plastics, concrete and wood, but generally refers to metals The rusting of ordinary steel is the most common form of corrosion

Maintenance, inspection and testing Corrosion prevention Some of the major harmful effects of corrosion include: Structural failure or breakdown of equipment Failure of vessels and pipes Mechanical damage to valves, pumps, etc, or blockage of pipes by solid corrosion products

Maintenance, inspection and testing Corrosion prevention Corrosion allowance Metal added to the design thickness against general corrosion loss Coatings The choice of coating is related to its intended function Cathodic and anodic protection This is the control of metal potentials to reduce the corrosion rate

Maintenance, inspection and testing Corrosion prevention Inhibitors These are substances added in small concentrations to reduce the corrosion rate Corrosion control and system history Repairs or local changes in a system may alter the requirements for corrosion inhibitors or chemicals required for process control Time-related corrosion changes in a system must also be accounted for

Maintenance, inspection and testing Corrosion prevention Quality control Confusion of materials must be avoided Where resistance to corrosion depends on correctly applied welding technology, it should be carried out to appropriately designed and qualified welding procedures

Maintenance, inspection and testing Corrosion prevention Corrosion awareness When corrosion reaches a critical level, it can lead to an expensive or catastrophic situation It is important that even those not involved in corrosion control or maintenance should have an understanding of the application, effects and benefits of a corrosion control programme and how their work may impact upon its efficiency

Maintenance, inspection and testing Corrosion prevention This plant was only about 5 years old, but due to poor maintenance was stained in many locations from acid seepage This made it hard to inspect and to know how it was ageing

Maintenance, inspection and testing Corrosion prevention These pre 1940’s riveted pressure vessels remained in good condition and successfully operated in service until the 1990’s

Maintenance, inspection and testing Corrosion prevention Competency and training Asset integrity management needs a high level of competency It is essential that staff involved not only have the skills, knowledge and competence to carry out their tasks, but also understand the performance standards required for the equipment (SCE’s) on which they are working

Risk based maintenance and inspection strategy The Accident Prevention Institute (API) Publication 581 - Base Resource Document: Risk Based Inspection (RBI); is an industry specific document designed to be applied to the petroleum and chemical process areas

Risk based maintenance and inspection strategy The approach recognises that a RBI programme aims to: - Define and measure the level of risk associated with an item - Evaluate safety, environmental and business interruption risks - Reduce risk of failure by the effective use of inspection resources

Risk based maintenance and inspection strategy The likelihood of failure is determined from the sum of six weighted factors: - Amount of equipment within item - Damage mechanism - Usefulness of inspection - Current equipment condition - Nature of process - Safety design and mechanisms

Risk based maintenance and inspection strategy The consequence of failure is divided into only two factors: - Fire/explosion - Toxicity

Risk based maintenance and inspection strategy The inspection programme is developed to reduce the risk by determining: - The type of damage to look for - How to look for damage - Where to look for damage - When to look for damage

Techniques, principles and importance of safe operation, standard operation procedures and maintenance In the major hazard industries, procedures are essential for safe operation: - To minimise errors/failures - To protect against loss of operating knowledge - To standardise working practices for safe operation - To ensure maintenance and return of equipment back is carried out correctly - To provide a basis for training - To meet statutory requirements

Techniques, principles and importance of safe operation, standard operation procedures and maintenance Typical procedures may include: - Standard operating procedures/operating philosophy - Abnormal operating procedures - Temporary operating procedures - Plant trials - Emergency operating procedures - Commissioning - Plant start-up/shut-down - Manage of change

Control of ignition sources during maintenance and operations Hazardous areas on an oil and gas installation (concerning the presence of flammable materials) are “zoned” Fixed sources of equipment are designed to prevent “sparking” during their operation Should they come into contact with a flammable material, they cannot ignite the material Maintenance work is periodically undertaken on or around, live process plant Such work must be strictly controlled, to avoid the possibility of fire and explosion

Cleaning and gas freeing of plant and equipment The operation of gas-freeing should be distinguished from that of cleaning Gas-freeing (or purging) means the removal of flammable gas or vapour from a tank Cleaning refers to the removal of solid and liquid residues Cleaning and gas freeing are processes that are applied to tanks, vessels or other equipment in order to prepare them for maintenance activities such as hotwork, confined space entry and inspection

Cleaning and gas freeing of plant and equipment Purging Venting Draining of water, product Oxygen Non-condensables (NCD’s) Inerting

Content 2.2 Process safety management (PSM) 2.1 Contractor management 2.2 Process safety management (PSM) 2.3 Role and purpose of a permit-to-work system 2.4 Key principles of safe shift handover 2.5 Plant operations and maintenance 2.6 Start up and shut down 71

Associated hazards and controls Start-up and shut-down The release of stored energy Flammable hydrocarbon release, leading to fires, explosion Toxic gas release Overpressure of plant and equipment Thermal shock Inadvertent starting of machinery

Maintenance, inspection and testing Hazards Shut-down controls Use of permit-to-work Isolation of equipment (electrical, mechanical etc) and LOTO Venting, draining, removal of materials from equipment Purging, cleaning of equipment Spading or blanking of equipment Ensuring that equipment is “gas free”

Associated hazards and controls Start-up controls All Permits closed out Spades, blanks removed De-isolation of equipment Instruments calibrated Alarms, gas detection systems functional ESD’s, flares, relief valves, deluge systems functional Pressure, leak, integrity testing Emergency plans in place

Associated hazards and controls Kick formation The downhole fluid pressures are controlled through the balancing of the hydrostatic pressure provided by the drilling mud used Should the mud pressure fall below the pore pressure of the formation fluids they will flow into the wellbore and up the annulus This is commonly called a ‘kick’ Can quickly escalate into a blowout (Gusher)

Associated hazards and controls Water and hydrates presence and removal In drilling, record water depths are continuously being set by oil companies in the search of hydrocarbon reserves in deep waters Due to environmental concerns and restrictions, water based drilling fluids are often more desirable than oil based fluids, especially in offshore exploration A well recognised hazard in deep water offshore drilling, using water based fluids, is the formation of gas hydrates in the event of a gas kick

Associated hazards and controls Water and hydrates presence and removal In deep-water drilling, the hydrostatic pressure of the column of drilling fluid and the relatively low seabed temperature, could provide suitable conditions for the formation of hydrates in the event of a gas kick This can cause serious well safety and control problems during the containment of the kick

Associated hazards and controls A large gas hydrate plug formed in a subsea hydrocarbon pipeline Source: Petrobras (Brazil)

Associated hazards and controls Dehydration system

Associated hazards and controls Testing, commissioning and hook up Testing Clear demarcation of where limits of intervention cease and reliance upon the control systems interface begins is a critical step in defining the operating procedures for a given plant or process The justification of reliance upon human intervention rather than automated systems should be established

Associated hazards and controls Testing, commissioning and hook up Controls The principle controls for start-up and shut-down are the safe working procedures The procedures should be ordered and phased so that interlinked plant operations can resume or cease in a safe and controlled manner

Associated hazards and controls Testing, commissioning and hook up Commissioning Commissioning of process plant is the practical test of the adequacy of prior preparations, including training of operating personnel and provision of adequate operating instructions Commissioning procedures document a logical progression of steps necessary to verify that installed plant is fully functional and fit for purpose

Associated hazards and controls Testing, commissioning and hook up Commissioning A general sequence of steps in commissioning may typically include: - System configuration check - Instrumentation system check - verification of alarms and trips - Flushing and cleaning of lines and vessels with water - Assessment of ancillary equipment - Calibration of vessels and instrumentation

Learning outcomes 2.1 Explain the principles of assessing and managing contractors, including the roles of parties involved 2.2 Outline the tools, standards, measurement, competency requirements and controls applicable to Process Safety Management (PSM) in the oil and gas industries 2.3 Explain the role and purpose of a permit-to-work system 2.4 Explain the key principles of safe shift handover 2.5 Explain the importance of safe plant operation and maintenance of hydrocarbon containing equipment and processes 2.6 Outline the hazards, risks and controls to ensure safe start up and shut down of hydrocarbon containing equipment and processes It is important from the offset to explain the purpose of this course. It is designed to enable managers to transfer their skills to the identification of hazards in the workplace and to determine the effectiveness of the controls in place. The course provides an overview of the reasons why safety should be managed as an equal partner to the other duties managers may have and as such it should be an integral part of their day to day work. The course will confirm some existing delegates understanding and may well provide additional skills to enable them to manage risks better in their workplace, but it is essentially an awareness course and will not make them experts in the topics covered and as such they will need to take expert on advice on specifics where they have uncertainty in the future. Emphasise that the delegates should take an active part throughout the course and share experiences freely to get the best out of the course. Finally the materials contain key learning points; reassure them that this is all they will need for the final written assessment; an example of this will follow shortly in the powerpoint. The core materials may be particularly useful when producing their workplace assignment, the second part of the assessment process, which will be discussed later in the course.

2 Hydrocarbon process safety 1 85