Loss of Containment Manual

Introduction ................................................................................................................................ 3
Part 1 - Management of process integrity .................................................................................. 5
Part 2 - Small bore tubing and piping systems......................................................................... 13
Part 3 - Information, instructions and training........................................................................... 21
Part 4 - Isolations and permits to work..................................................................................... 25
Part 5 - Process plant protection systems................................................................................ 31
Part 6 - Change control ............................................................................................................ 39
Part 7 - Maintenance and verification of process safety-critical elements................................ 45
Part 8 - Control of miscellaneous process hazards.................................................................. 51
Part 9 - FPSO specific systems ............................................................................................... 59
Part 10 - Process plant construction & commissioning ............................................................ 63

Issue 3 January 2012

Review date: January 2015
Author section: HID OSD3.1

-1-

-2-

Introduction
Reducing Offshore Hydrocarbon Releases
This document, originally designed to give guidance to inspectors under the Key Programme 1
- Reducing offshore hydrocarbon releases initiative, indicates ten important elements relating
to the management of the integrity of the process containment envelope and provides advice
on topics for inspection within each of the elements. The maintenance of high standards of
operation in these areas should help to minimise the frequency of occurrence of offshore
hydrocarbon leaks.
Asset Integrity Programme
This programme, known as KP3 ran from 2004 to 2007. It focused on the effective
management and maintenance of safety critical elements. Inspectors using a template, which
covered a number of key topics, obtained an overall picture of industry performance. One
topic, relevant to loss of containment prevention, where performance was poor was Topic C
Maintenance of safety critical elements.
Offshore Hydrocarbon Releases
HSL was asked to identify the main causes of major and significant releases between 2001
and 2007 using the Hydrocarbon Releases Database. Information was obtained on systems,
equipment types, equipment causes, operational causes, procedural cause and operational
mode. The key issues and underlying causes relating to hydrocarbon releases are
summarised below.

Evidence suggests that piping systems, including flanges and valves collectively
continue to be a major source of Hydro Carbon Releases (HCRs), with piping being the
single largest contributor. Instruments (i.e. Small Bore Tubings (SBTs)) contribute the
second largest single source of HCRs. Gas Compression is the operating system
having the highest number of HCRs.

Incorrectly fitted equipment is the most widespread operational cause followed by

improper operation (i.e. human factor issues) where operational failures are reported.

Non-compliance with procedure (i.e. human factors issue) is the most common
procedural cause where procedural failures are reported.

Reported experience of inspection and survey on SBT systems suggests that 26% of
fittings examined are found to contain faults, e.g. under-tightness, incorrect or
mismatched components, leaks, incorrect or poor installation, etc., and that this failure
rate has remained constant from 2001 to 2007.

-3-

Part 1 - Management of process integrity

This part involves onshore inspection. It reviews the way in which process integrity is
managed, and is intended to examine and reinforce the role of onshore management.
Item
1.1

Inspection Topics
Guidance Notes
Policy / Record of Arrangements

1.1.1

Is there a policy statement,

and / or any other record of
the arrangements for
managing process safety, or
is it rolled into the overall
SMS?
If so, is it adequately
defined, communicated, and
put into practice?
Is process integrity
adequately included in an
SMS improvement
programme?

A good policy statement, or record of arrangements, would

include principles such as:

inherent safety
hierarchy of prevention, detection, control, mitigation
role of risk assessment and ALARP principles
maintaining up to date documentation
competence, and adequacy of resources
working within a safe operating envelope
control of changes that impact on process safety
maintenance / verification of safety critical systems
line management monitoring
independent management and technical audits
establishing basic causes of accidents / incidents
reviewing process safety performance
continuous improvement, with improvement plans
Principles of quality management e.g. ISO 9000.

Legal
Basis

An employer has a legal duty under s.2 (3) of HSWA to have a written policy statement
with respect to health and safety. This statement of his general policy should include the
organisation and arrangements for carrying out that policy, including those applicable to
process safety. MHSWR, Reg. 5 requires a record of arrangements for planning,
organisation, control, monitoring and review of preventive and protective measures. A
policy statement addressing process safety management will help define the management
requirements. Senior management should endorse the policy, which should be adequately
communicated; commitment to it should be visibly demonstrated.

1.2

Accountabilities / Responsibilities / Resources

1.2.1

Accountabilities etc.
Are responsibilities /
accountabilities for process
integrity adequately defined
and allocated (e.g. between
operational and technical
functions)?

1.2.2

Technical Support

Responsibilities for process integrity should be assigned,

and accountability reinforced through job descriptions.
There should be a senior figure in the organisation to coordinate general safety policy implementation, and a
safety management programme with objectives and
performance criteria. Process safety may have a separate
programme, or it may be integrated into the general
programme.
Responsibilities should generally be allocated to line
managers, with specialists acting as advisers.
Responsibilities and accountabilities should be clearly
assigned (e.g. responsibilities should be allocated
between operational and technical functions, with a
nominated technical custodian for process integrity) and
appropriately reinforced (e.g. through performance
reviews). Line management should be actively involved in
monitoring performance, and evaluating the achievement
of performance criteria.
There should be sufficient resources and expertise for

-5-

Item

Legal
Basis

1.3
1.3.1

Inspection Topics

Guidance Notes

process safety requirements. There is no legal

requirement for technical support to be provided in house.
How is technical support
However, some of OSDs process safety audits have
provided, and how is the
noted a lack of expertise where there has been
adequacy of this support
outsourcing of engineering requirements.
assessed?
MHSWR Reg. 5 requires an organisational structure to provide for progressive
improvement in health and safety, and adequate control to ensure that decisions are
implemented as planned. Otherwise, the requirements specified in the guidance notes
above should be treated as good practice rather than legal requirements.
Communication
Do managers demonstrate HSG65 notes that communication is often the single most
important area that requires improvement. It is important
their commitment to
for management to demonstrate commitment through
process integrity through
written/verbal communications, installation visits etc.
effective and appropriate
Communications of particular relevance to process
communication?
integrity are:

Legal
Basis

The meaning and purpose of the policy for process

integrity
Objectives, standards, and procedures relating to
policy implementation
Communications to secure involvement and
commitment of employees
Responses to comments and ideas for improvement
Meetings where teams discuss process related safety
matters
Discussion of lessons from accidents and incidents
Communication of plant status at shift and crew
change handovers
HSWA s.2(2)(c) requires the provision of such information, instruction and supervision as
is necessary..., and s.2(6) requires employers to consult representatives over
arrangements which will enable the employer and employees to co-operate effectively.
MHSWR Reg. 10 requires employers to provide employees with comprehensible and
relevant information on risks to their health and safety, preventive and protective
measures, and emergency procedures. Reg. 11 requires co-operation and co-ordination
of measures between different employers in the same workplace; it is not applicable to cooperation between employers and employees.

1.4

Training / Competence

1.4.1

Training content for

process personnel
What safety-related processspecific training
requirements have been
defined for process
personnel?

The design of a training programme for process personnel

should include the general training that everyone on the
installation receives, and process-specific training.
Training should include Management of Change
procedures, and techniques for process Hazards Analysis
and Risk Assessments. Duty holders should define:

How (safety related) process training objectives are

set;
What subjects are to be included in the training
programme;
Responsibility for developing and validating training
material;
How primary responsibility for the training is assigned;
How competence is established.

-6-

Item

Inspection Topics

Guidance Notes
Process specific training should deal with:

the basic process

the design of plant
critical factors which affect productivity and safety
important process safety considerations relating to
flammability, explosivity, and toxicity

Task specific training generally starts with basic

principles of common unit operations, such as separation,
heat transfer, pump and compressor operation, and
concepts of process control. Specific unit training would
then concentrate on details of the units that comprise the
process.
Operations procedures would be covered, including;

safe operating limits

actions to keep within safe limits, and consequences
of failing to do so
procedures for start up, normal operation and
shutdown
contingency procedures for upsets and / or
emergencies

Training should be given as appropriate in Management

of Change procedures and in techniques for Hazards
Analysis and Risk Assessment.

1.4.2

Training content for other

relevant personnel
What safety-related processspecific training
requirements have been
defined for maintenance
personnel, and others such
as contractor organisations?

1.4.3

Training responsibilities /
programme evaluation
Who is responsible for
developing / validating
training material, carrying out
training, reviewing needs?

Training should be frequent enough to maintain skills;

frequencies should be specified. It may be that for some
infrequent operations, training should be given each time
the operation is undertaken. Training records should be
kept for comparison with the schedule.
Training for maintenance personnel in process areas
should include general process safety training, and
relevant aspects of process specific training. The training
should then focus on standard maintenance operations,
such as working in specific hazardous locations.
Contractor organisations should be provided with
sufficient process hazard information, and site-specific
information necessary for them to train their employees.
Training effectiveness, and competence, may be
determined by a variety of means, including written / oral
testing, demonstrations in the field, random spot-checking,
and incident reviews.

-7-

Item

Inspection Topics

1.4.4

Competence

Legal
Basis

1.5

Guidance Notes

Competence includes knowledge, skills, experience, and

personal qualities. Offshore industry guidance (E&P
How is competence
Forum Guidelines), states that systems of competence
established / assured?
assurance should apply, to initial recruitment and selection
for new activities, and to both staff and contractors.
Competence assessment schemes are available for
process operators and maintenance technicians, and
many companies have formal in-house schemes.
Training does not guarantee competence, but it
contributes towards it; it can be categorised into general
and specific training. General training includes those
subjects with which everyone at the facility should be
familiar. Specific training covers core or trade skills.
Competence assessment of core / trade skills is probably
the most widely developed, and lead bodies, such as
OPITO, set competence criteria on which qualifications
can be based. NVQ / SVQ competence assessment
schemes are available for process operators and
maintenance technicians, and many companies have
formal in-house schemes.
Competence assurance programmes are recognised good practice (e.g. Oil and Gas UK
and E&P Forum Guidelines). PUWER Reg. 9 requires employers to ensure that all
persons who use work equipment have received adequate training, including training in
methods of use, risks such use may entail, and precautions to be taken. PUWER Reg 3(3)
extends this duty to others who have control, to any extent, of work equipment, including
duty holders. MHSWR places specific requirements on employers to provide information
for employees (Reg. 8), and to take their employees capabilities into account, and ensure
they are provided with adequate health and safety training (Reg. 13).

Identification of basic / underlying causes in process incidents

Methodology
Is there a defined
methodology for establishing
basic causes?
How has this been applied
for recent process-related
incidents?
Has potential human failure
and its impact on the
process-related incident
been considered?
Have the underlying causes
of the process incidents
been identified?

As technical systems have become more reliable, the

focus has turned to human causes of accidents. HSG48
states that up to 80% of accidents may be attributed, at
least in part, to the actions or omissions of people. The
reasons for the errors of individuals are usually rooted
deeper in the organisation's design, decision-making, and
management functions. HSG48 gives several examples of
major accidents where failures of people at many levels
(i.e. organisational failures) contributed substantially
towards the accidents. Human factors topics of particular
relevance to process integrity include:

ergonomic design of plant, control and alarm systems

style and content of operating procedures
management of fatigue and shift work
shift / crew change communications, and
actions intended to establish a positive safety culture,
including active monitoring.

Human factors cover a broad field. In the past, duty

holders may have viewed it as being too complex or
difficult to do anything about, but a range of measures is
now available. There should be a systematic analysis of
the causes of human failure, and appropriate measures
should be implemented. For example the Human Factors
Roadmap is a practical approach to the management of of
major accident hazards (MAHs), developed by HSE, it is a
framework whereby MAHs are linked to the assured

-8-

Item

Inspection Topics

Guidance Notes
performance of humans engaged on safety critical tasks
associated with those hazards. It includes as key
milestones identification of safety critical tasks, task
analysis and human error analysis (together with
consideration of performance influencing factors).
Investigation procedures should address both immediate
and underlying causes, including human factors. HSG65
Appendix 5 describes one approach that may be used as
a guide for analysing the immediate and underlying
causes of effects. There are several other methodologies
available in the industry.

Legal
Basis

MHSWR Reg 5 requires employers to make arrangements for the effective planning,
organisation, control, monitoring and review of the preventive and protective measures
defined in Reg 1 Paragraph 36 of the ACOP to the regulations indicates that monitoring
includes investigating the immediate and underlying causes of incidents, to ensure that
remedial action is taken, lessons are learnt and longer term objectives are introduced..

1.6

Monitoring of process systems and procedures

1.6.1

Arrangements
What monitoring
arrangements are in place
for key risk control
procedures?

Active monitoring gives an organisation feedback on its

performance before an incident occurs. It should be seen
as a means of reinforcing positive achievement, rather
than penalising failure after the event. It includes
monitoring the achievement of specific plans and
objectives, the operation of the SMS, and compliance with
performance standards. This provides a firm basis for
decisions about improvements in risk control and the SMS.
Leading indicators are the outcome of active monitoring,
for example the number or percentage of specific audits of
work activity conducted against the plan.
Reactive monitoring is, by definition, triggered after an
event, and includes identifying, reporting and measuring
injuries, dangerous occurrences (including near misses),
other losses, observation of hazards etc. The
requirements for reactive monitoring are not specific to
process integrity. Lagging indicators are the outcome of
reactive monitoring, for example the number of incidents
that have occurred as a result of human error.
HSG254 describes a six step approach to developing
process safety indicators, in brief these are:
1. establish the organisational arrangements to
implement the indicators
2. decide on the scope of the measurement system
3. identify the risk control systems, decide on the
outcomes and set lagging indicators
4. identify critical elements of each risk control system
and set leading indicators
5. establish data collection and reporting system
6. review data and take action.
Step 3 should include the identification of underlying
causes in process incidents as well as identifying risk
control systems that are in place to prevent or mitigate the
effects of the incidents identified.

-9-

Item

1.6.2

Inspection Topics

Allocation of
responsibilities
How have responsibilities
been allocated between
onshore and offshore staff?

1.6.3

Process Safety Leadership

Do the most senior
managers within the
organisation routinely
receive information on
process safety performance?
How is the information used?
What impact does it have on
the management of process
safety risks?
What changes have been
made within the organisation
as a result of the information
provided?
Are the process safety
indicators set at:
plant/installation; site;
organisational level; or a
combination of the above?
How was the scope of the
indicators set? Are they
based on: process safety
and major hazard risk profile,
where greater business
assurance is needed, or
improvement programmes?

Guidance Notes
Understanding of risk control systems is facilitated by, for
instance, the bow-tie diagram and barrier diagrams (e.g.
Reasons Swiss Cheese Model). Consideration should be
given to each risk control measure identified on the
diagram as a relevant measure in order to effectively
manage process integrity.
Organisations need to decide how to allocate
responsibilities for monitoring at different levels in the
management chain, and what level of detail is appropriate.
In general, managers should monitor the achievement of
objectives and compliance with standards for which their
subordinates are responsible. Managers and supervisors
responsible for direct implementation of standards should
monitor compliance in detail. Above this immediate level of
control, monitoring needs to be more selective, but provide
assurance that adequate first line monitoring is taking
place.
Directors and senior managers should be actively involved
in the control of business risks (corporate governance).
(HSG254 page 7 Step 1.3). Senior managers should
understand fully the business benefits of performance
measurement and clearly see how managing process
safety contributes to the success and sustainability of their
company. Performance indicators should be used to show
the status of the process safety management system.
Direct and tangible action should be taken to make
improvements where necessary based on the information
gained from performance indicators. (HSG254 page 14,
Step 3.4 & page 17, Step 4.4).
The indicators should be chosen to provide the
management team with the right scope and level of
information they need to be satisfied that process safety
risks are under control
The management should: actively participate in the
development of indicators and the setting of tolerances;
routinely see and act upon the information provided from
the process safety measurement system. (HSG254 page 7
Step 1.3). Both leading and lagging indicators should be
used to monitor specific process safety risks (HSG254
page 2 Figure1: Dual Assurance). Information from the
measurement system should have a clear and tangible
impact on the management of process safety risks.

- 10 -

Item

Inspection Topics

Guidance Notes

1.6.4

Content of monitoring
programmes

Various forms and levels of active monitoring include:

Do the formal monitoring

arrangements include:

1.6.5

change control
isolation practices
control of locked valves
control of overrides on
process protection
systems
adequacy of local risk
assessments etc.?

Records
What records are kept, how
are the results reviewed, and
actions implemented?

examination of work and behaviour

systematic examination of premises, plant and
equipment by managers, supervisors, safety
representatives, or other employees to ensure
continued operation of workplace risk precautions
the operation of audit systems
routine monitoring of progress towards specific
objectives e.g. training / competence assurance
objectives.

Many of these topics are not specific to process integrity,

but are equally applicable to all areas. Topics which are of
particular relevance to process integrity, however, include:
Permit to Work Systems, isolation standards, change
control, HAZOP close out, procedural controls for process
plant protection systems, controls at HP / LP interfaces,
operating procedures, workplace risk assessments etc.
Verification that suitable records are accurate, complete
and being maintained (e.g. a record of risk assessments).
Safety case regulations covering offshore installations
require duty holders to keep more detailed records of
process hazards, risks and precautions.

Legal
Basis

MHSWR Reg. 5 places a general obligation on employers to monitor preventive and

protective measures. SCR Reg. 13 management of health and safety and control of major
accident hazards. The measurement of process safety indicators is recognised good
practice (ref. HSG254).

1.7

Audit and review of process plant and management systems

1.7.1

Audit scope
How is process integrity
catered for in the audit
programme?

1.7.2

Audit description

HSG 65 refers to auditing as the structured process of

collecting independent information on the efficiency,
effectiveness, and reliability of the total health and safety
management system, and drawing up plans for corrective
action.
Auditing is not a substitute for active monitoring. Auditing
supports monitoring by providing managers with
information on how effectively the SMS is being
implemented. The aims of auditing should be to ensure
that appropriate management arrangements are in place,
adequate risk control systems are implemented, and
workplace precautions are in place. Various methods can
achieve this, and some parts of the system do not need to
be audited as often as others.
AIChE Guidelines draw a distinction between process
safety auditing, and Process Safety Management System
(PSMS) auditing. Both types are important. Process safety
auditing focuses on specific hazards (e.g. hardware
systems). PSMS auditing, involves assessment and
verification of the management systems that ensure
ongoing control (e.g. the management systems in place to
ensure that pressure relief devices have been designed,
installed, operated, and maintained in accordance with
company standards).

- 11 -

Item

Inspection Topics

Guidance Notes

1.7.3

Audit implementation

1.7.4

What process management

audits have been carried out
in the past 3 years, and how
have they been organised?
(Aim to form a judgement on
the adequacy of these
audits)
Review of audits

The auditing process should involve the collection of

information about the offshore installations and
management system providing the duty holder with an
impression of how effectively the process safety
management system is controlling risk, so that judgements
can be made about the adequacy and performance of the
system.

How are process-related

audits and monitoring
activities reviewed, and
improvement programmes
developed?

1.7.5

Legal
Basis

Reviews of process plant

Reviewing should be based on information from

measuring (i.e. active and reactive monitoring) and
auditing activities.
Organisations should clarify how process integrity is to be
included in the review process. In all reviewing activity, the
result should be specific remedial actions which establish
who is responsible for implementation, and set deadlines
for completion.
Standards change, and it is good practice to review the
adequacy of existing plant against current standards from
time to time (say every 5 years).

What reviews have been

carried out of process plant
against current standards?
SCR Reg. 12 require an audit system which is adequate for ensuring that relevant
statutory legal provisions, including the provisions relating to process integrity in PFEER
and DCR, are complied with. Process integrity safety management systems audits are
recognised good practice.

MHSWR Reg. 5 require effective arrangements for monitoring and review of preventive
and protective measures.

- 12 -

Part 2 - Small bore tubing and piping systems

This part reviews the way in which small bore tubing and piping systems are managed,
together with small bore flexible hoses which may be used for hydrocarbon duties. The
guidance notes are largely based on Institute of Petroleum / Oil and Gas UK Guidelines for
the Management, Design, Installation and Maintenance of Small Bore Tubing Systems.
Item
2.1

Inspection Topic
Guidance Notes
Management Systems for Small Bore Tubing

2.1.1

Overview

2.1.2

Have the management

arrangements been reviewed
against IP / Oil and Gas UK
Guidelines, or has the duty
holder (DH) got other
appropriate guidelines to work
to?
Responsibilities

2.1.3

Are responsibilities /
accountabilities adequately
defined for management of
small bore tubing?
Training and Competence
How is competence
established / assured?

Is there a register of
competent persons?

How is the competence of

vendors addressed?

2.1.4

Standardisation Policy and

Procedures
Do the DH procedures
address the issue of
standardisation for small bore
tubing and fittings?

The DH should ensure that the integrity of small bore

tubing system over the whole life of the plant is addressed
within the management system. This should be achieved
as a matter of management policy by specifically
identifying small bore tubing systems within the
engineering design, construction, maintenance and
operations standards and procedures, with special
emphasis being placed on personnel competency.
IP Guidelines state that responsibility for carrying out
management policy should be allocated to technical
authorities within the management system. The monitoring
of the implementation of the policy should be specifically
included within the Technical Audit programme.
IP guidelines states that the duty holder should have a
formal competence assurance scheme which ensures that
all the personnel (company and contractor) required to
work on small bore tubing systems are formally assessed
as being competent to work with small bore tubing and
fittings. Such a scheme should cover the range of
knowledge and task skills appropriate to small-bore tubing
and fittings on the installation.
The DH should ensure the long-term retention of
competence by periodic reassessment of personnel.
Personnel assessed as being competent should be
registered as being Authorised to carry out the range of
tasks in which they have been assessed as being
competent.
Management procedures should ensure that Vendor
personnel employed on short term construction or
maintenance work are competent to carry out such work
and it is recommended that their competence is also
recorded in the register of authorised personnel.
A control and standardisation policy for the technical
management and minimisation of small-bore tubing and
fittings types should be developed, documented and
implemented for each new and existing installation.
On installations where several makes and types of tubing
and fittings are already present, it may not be reasonably
practicable to change all systems. In this case it should be
demonstrated that the range of fittings and tubes have
been minimised to a manageable level, and that personnel
competencies are consistent with the residual inventory.
Policy and Procedures should address the following:

- 13 -

Item

Inspection Topic

Guidance Notes

2.1.5

Maintenance and
Operational Procedures
Does the DH have specific
maintenance and operational
procedures for small bore
tubing?
Have these been reviewed
against the IP / Oil and Gas
UK Guidelines?

2.1.6

Reinstatement Procedures
Do the maintenance and
operational procedures cover
reinstatement of small bore
tubing and fittings?

preferred fitting and tube types per plant

the fitting and tube type per system or sub system
the planned fitting and tube type migration per system
or sub-system
the strategy to minimise the inventory by design-out,
refurbishment and ad-hoc maintenance activities
a company or installation directive for new and
replacement systems to comply with the preferred
equipment requirement
vendor compliance with the policy.
Procedures should include:

the overall integrity of the system

visual inspection of compression fittings for correct
component selection and correct make-up (with use of
manufacturer's gauge as applicable)
process leakage or seepage from compression joints
and pipe thread connections
sample disassembly of compression fittings to check
for correct make-up, tube penetration and internal
corrosion of tube and clamp
examination of support and mounting for vibration
control
check to identify possible problems with maintainability,
i.e. access, corrosion, ease of removal etc.
minimum of full three threads engagement on fully
assembled joints.
Procedures for pressure testing and leak testing should be
available for:

reinstatement of systems which have been subject to

extensive disconnection or involves the installation of
untested fabricated equipment, and for
reinstatement of individual impulse lines which have
been subject to minor disconnection.

Adjustment and rework should not be permitted on

systems whilst pressurised or not adequately isolated.
Legal
Basis

PUWER Regs 3,4,5,6,8 and 9 require employers, and duty holders (Reg. 3), to ensure:
Work equipment is constructed or adapted so as to be suitable for the purpose for which it is
provided (Reg. 4); work equipment is maintained in an efficient state, efficient working order,
and good repair (Reg. 5); where work equipment is of a type where safe operation is
critically dependent on it being properly installed, (or reinstalled) the equipment is inspected
before being put into service, and at suitable intervals (Reg. 6); people who use work
equipment have adequate health and safety information, and written instructions (Reg. 8);
all persons who use work equipment have received adequate training (Reg. 9).
PFEER Reg. 5 and 9, and MHSWR Reg. 5 are also relevant.

2.2

Control of Risks from Vibration

- 14 -

Item

Inspection Topic

Guidance Notes

2.2.1

Identification of Vibration
Problems

Process piping systems have traditionally been designed

on the basis of static analysis with little attention paid to
vibration-induced fatigue. Significant contributory factors to
vibration related fatigue failures have been:

Has the DH identified any

piping vibration problem, or
given consideration to the
potential existence of such a
problem?

2.2.2

Assessment of Vibration
Does the DH have a structured
assessment methodology to
identify potential problem
areas?
Has the duty holder addressed
the issue of excitation
mechanism in the
methodology? (Stage 1)
What further analysis of the
vibration sensitive system has
been undertaken? (Stages 2
and 3)

increased flowrates as a result of debottlenecking and

relaxation of erosion velocity limits, resulting in greater
level of turbulent energy in process systems
greater use of thin walled pipework made possible by
the use of new higher strength materials (i.e duplex
stainless steel), resulting in more flexible pipework and
higher stress concentration at small bore connections.
The DH should have a structured assessment
methodology in place. A suitable assessment may include
the following three stages, or similar process:
Stage 1: Divide the plant into manageable systems and
identify whether there is a potential problem for each
system. The possible excitation mechanisms for each
system are:

flow induced turbulence

high frequency excitation
mechanical excitation
pulsation

Stage 2: A system that has been identified to have a

problem should be further analysed to determine the
extent to which the potential excitation mechanism will
cause vibration problems in pipework. If the likelihood of
failure is high or medium, then a stage 3 assessment
should be undertaken.
Stage 3: In this stage, the features of the small bore pipe
and its connection to the main pipe should be reviewed.
The contribution of each feature to the likelihood of failure
of the small-bore connection (SBC) should be identified.
Important features are type of fitting (i.e. weldolet,
contoured body, short contoured body etc.), length of
branch, number and sizes of valves, main and small bore
pipe wall thickness (schedule), small bore connection
diameter, location of small bore pipe on the main pipe.

- 15 -

Item

Inspection Topic

Guidance Notes

2.2.3

Remedial Actions following

Stages 2 and 3

If likelihood of failure is assessed as high in Stage 2, then

where possible the main pipe should be redesigned, resupported, or a detailed analysis conducted. In addition,
the small-bore pipe connection should be assessed as in
Stage 3. The following design solutions could be applied to
reduce failure of a SBC due to vibration:

Has the duty holder identified

remedial actions following a
structured assessment?
Have these actions been
implemented?

the fitting and overall unsupported length should be as

short as possible
mass of unsupported valves / instruments should be
minimised
mass at the free end of a cantilever pipe assembly
should be supported in both directions perpendicular to
axis of the small bore
supports should be from the main pipe, to ensure that
the small bore connection moves with the parent pipe
diam. of small bore connections should be maximised

Legal
Basis

See Legal Basis in Section 2.1 for details

2.3

Small Bore Tubing Systems in Practice

2.3.1

Field Installation practice

How is interchange of subcomponents prevented?
How are fittings inspected prior
to installation and on
completion?
What training / competence
assessment has been carried
out, and how is work on small
bore tubing restricted to
competent persons?

2.3.2

Integrity of supporting
arrangements
Are the supporting
arrangements in accordance
with specified arrangements?
(To be examined for selected
systems)

The DH should make procedures available to installation

personnel who deal with the selection, assembly and
inspection of the range of tubing and fittings that they will
encounter. The following instructions should be part of
these procedures:

it is not permissible to interchange sub-components of

different designs or types of fittings
the installation and assembly of particular types of
small bore tubing and fittings must be made in
accordance with the manufacturers instructions. (Note:
these can be different between manufacturers and
between fitting sizes of the same manufacturer)
it is essential that fitting is inspected on completion
using gauges where available or by other methods
recommended by the manufacturers
appropriate tools should be defined and used and
special tools, such as hydraulic swaging machine
should be considered for fittings of larger sizes of
fittings and tubing.
Tube support should be provided as per manufacturers
instructions to prevent unacceptable stresses on fittings
e.g. eliminate sagging and vibration.
Valves, gauges etc. should be independently mounted.
Expansion loops should be provided as per design. Tube
support material should be as per design specification.
Tube systems should be adequately supported as
necessary when connections are being tightened or
uncoupled.

2.3.3

Isolation practices and

standards

Guidance on isolation for instrumentation is provided in

HSG253 The safe isolation of plant and equipment
Appendix 9.

Does the DHs isolation

- 16 -

Item

Inspection Topic

Guidance Notes

procedure address the

particular requirements for
small bore tubing?

A primary isolation valve (piping standard) should be

located close to the pipe or vessel, and be to the same
standard of pressure integrity. Instrument connections
beyond the primary isolation facility are sometimes less
robust than the primary connection e.g. compression fitting
may be used in the impulse tubing and the instrument may
use components such as flexible hoses or sight glasses.

How do isolation standards on

site compare with
recommended practice?

Instruments will generally be provided with local isolation

facilities that, together with the primary isolation, can
provide a double block and bleed isolation. Drain, vent and
test points should be provided with valves to close them
off when not in use.
Guidance can be found in the EI/HSE publication
Is there any evidence of
Guidelines for the Avoidance of Vibration Induced Fatigue
vibration problems on site, or
in Process Pipework 2nd Edition, 2008.
of remedial actions from
vibration assessment not
There are various signs and indicators of possible
implemented?
vibration issues including:
Fatigue failure or damage to plant on items such as
How does the DH assure the
small bore connections, instrumentation, connections
integrity of plant against
or braces;
vibration-induced fatigue?
Damage to supports, connections, or braces;
[Gascet section 4.3.3]
Fretting of pipework and/or associated structures;
Weeping/leaking from instrument tubing; and
Perceived high levels of noise and vibration.
See Legal Basis in Section 2.1 for details
Are ends that are open to
atmosphere plugged or
blanked?

2.3.4

Legal
Basis

2.4

Control of Small Bore Flexible Hoses for Hydrocarbon Duty

2.4.1

Management of flexible
hoses

The EI/Oil & Gas UK/HSE guidelines provide advice on

the whole lifecycle of flexible hose management.

Awareness of published EI/Oil

& Gas UK/HSE guidance (Feb
2011) Guidance for the
management of flexible hose
assemblies.

Duty holders should ensure that integrity of small bore

flexible hoses used on hydrocarbon/hazardous processing
plant is addressed within their management system.
Elements should include consideration of design, risk
assessment, construction, installation, commissioning,
operation, maintenance, testing, modification and
decommissioning.

What systems / procedures

are in place for selection and
use of small bore flexible
hoses in hydrocarbon or other
hazardous service?
Competence and awareness.

Persons responsible for hose selection, maintenance or

use should be suitably competent and aware of safety
critical factors affecting hose integrity through an
understanding of hose constructional elements and their
function in maintaining integrity, failure modes, failure
criteria, etc. More detail is given in Annex A of the EI/Oil &
Gas UK/HSE guidelines.

- 17 -

Item

Inspection Topic

Guidance Notes

2.4.2

Risk Assessment, Selection,

Installation and Performance

Hose assemblies should only be used in hazardous duties

where permanent piped solutions are not suitable or do
not offer a safer alternative solution. Hoses should be
classified according to the consequence of failure. The
EI/Oil & Gas UK/HSE guidelines offer one approach for
risk assessment and classification of hoses.

Are hose assemblies being

used in suitable applications?
Have hose assemblies been
subjected to a suitable risk
assessment and classification
process?
Are hoses installed to
recognised good practice?

When deciding upon the performance and safe operational

requirement of a hose, parameters for consideration
include (see Annex F of EI/Oil & Gas UK/HSE guidelines):

2.4.3

What maintenance, inspection

and monitoring procedures are
in place for small bore flexible
hoses?

compatibility of inner liner material with the media to be

carried
compatibility of outer cover with working environment
flow requirements
pressure and temperature range
the operational environment - length, flexibility and
bend radius
weight, compactness and support requirements
volumetric expansion, movement under loading
compatibility of hose with end fittings, and fitting
compatibility with media and operational environment.

All hoses in critical service applications should be

examined on a regular basis, to assess their suitability for
continued service. Inspection frequency and criteria should
be developed from the risk assessment derived from the
classification process as per clause 2.4.2 (above).
Hoses and their fittings should be visually examined for
physical damage against defined criteria including: (a)
blisters or bulges (b) looseness of the outer cover (c)
excessive softening or hardening of the hose (any of these
three points may indicate fractured or displaced
reinforcement or a leaking liner) (d) kinks, twists (poor
installation) (e) abrasion, cuts, excessive elongation under
load or test (f) end coupling integrity.
Inspection and rejection criteria are given in the EI/Oil &
Gas UK/HSE guidelines section 8.5.3.
Any hose exhibiting cover cracks, cuts or bulges should be
removed from service, examined and retested as
necessary.

2.4.4

Legal
Basis

Any hose with reinforcement exposed should be removed

from service and replaced if extent of damage exceeds
manufacturer recommended limits. If in doubt, hoses
displaying visible faults should be replaced.
Pressure testing should be carried out in compliance with
Testing / records / tagging
relevant vendors procedure. Records of visual
examination should be kept, recording the condition of the
Check the DHs test records,
inspection records and tagging hose on a particular date and the date of next inspection.
The hose should be tagged with the latest inspection date
arrangements.
and the date of next inspection.
See Legal Basis in section 2.1 for details

- 18 -

Item

Inspection Topic

Guidance Notes

SCR requires safety critical elements to be verified by independent competent persons.

This may include flexible hose assemblies.
Pressure Equipment Regulations 1999 (PER) applies to fixed installations between well and
pipeline, for equipment installed by the manufacturer, which may include flexible hose
assemblies. PER does not apply to mobile offshore drilling units (MODUs) and equipment
assembled under the responsibility of the user, including well control equipment and
pipelines.

- 19 -

Part 3 - Information, instructions and training

This part reviews the way in which documentation for process integrity is maintained, key
communications managed, and competence assured. It involves a mix of onshore and offshore
inspection; inspectors will need to decide on the best place to obtain the relevant information.
Item
3.1

Inspection Topics
Guidance Notes
Design data / as built status

3.1.1

Document control
procedures

3.1.2

What procedures are in place

for retaining design data and
updating to built status as
changes take place?
Data for process equipment
Select a few examples of
process plant to verify that a
system exists to ensure data
sources are reliable, up to
date, and available to people
who need to have access to
them.

3.1.3

3.1.4

3.1.5

3.1.6

The SMS should ensure that information is kept current

throughout process changes, equipment maintenance,
and other normal activities. Responsibility should be
assigned, and resources allocated to this.

Specification sheets should be provided for each piece

of process equipment such as pumps, compressors,
vessels, heat exchangers, pressure relief / safety valves
etc. These sheets should typically show the design
codes and standards used, the expected process
conditions, the design conditions, the materials of
construction, and other mechanical details. Much of the
process design information is normally shown on
Process Flow Diagrams, which can show information in
varying levels of detail.

How is documentation updated

During the life of a plant, modifications are made to
after changes to process or
process and equipment. Each change should be
equipment specifications?
evaluated to assure that the process safety design is not
compromised, and equipment data sheets should be
appropriately updated.
Instruments which may be important to maintaining
Data for instruments
process safety include sensors, transmitters, controllers,
control valves, pressure reducers etc. Each of the
Check that up to date data
instruments should have a specification sheet, with
sheets are available for a few
design conditions, required materials of construction for
key examples of protective
the portions in contact with process fluids, as well as the
instrumentation.
range it must cover, and its protective function.
Piping specifications include, for each line, the type of
Data for piping systems
pipe used along with data on the types of fittings, valves,
and gasket materials that are acceptable for the
Check what documentation is
expected process materials and conditions, and the
available on specifications for
acceptable standards and conditions that the piping
piping systems.
components must meet.
Since there are usually only a limited number of copies
Vendor data
of technical data for these units, at least one set of the
vendor documents should be maintained on a central file
Check the availability of
with controlled access. Other copies may be utilised
relevant documentation.
where most required for reference or troubleshooting.
P&IDs show all process and utility piping,
P&IDs
instrumentation and protective systems. These drawings
also typically show design temperature and pressure
Check the status of P&IDs.
When were they last updated, ratings for vessels, piping specifications, relief valve
settings, capacities of vessels etc.
and how have recent
modifications been
Vendor packages within a process should be identified
incorporated?

- 21 -

Item

Inspection Topics

Guidance Notes
on P&IDs.

Do P&IDs identify vendor

package boundaries?

3.1.8

Legal
Basis

Where control of process safety is dependent on

procedural arrangements for control of valve positions
(e.g. locked valve controls on shutdown valve bypasses,
Are locked valve positions
at HP / LP interfaces, or on pressure relief systems).
identified on P&IDs?
Cause and Effects Diagrams API RP 14C states that a safety analysis function
evaluation (SAFE) chart (similar in format to a cause and
Check that an up to date C&E
effect chart) should relate all sensing devices, SDVs and
chart is available.
emergency support systems to their functions. (No other
specific guidance has been found on cause and effect
diagrams, although they are established practice
offshore).
PUWER Reg. 8 requires employers to ensure that all persons who use work equipment
have adequate health and safety information and, where appropriate, written
instructions.
HSWA s2(2)(c) requires the provision of such information, as is necessary.

3.2

Safe Operating Limits and Process Plant Protection Settings

3.2.1

Identification of Safe
Operating Limits

Safe operating limits should be specified for pressure,

temperature, level and flow, and other parameters that
may be applicable, such as process composition or
material additions.

3.2.2

Check how safe operating

limits are recorded.
Protection settings

Legal
Basis

Check that there is an

unambiguous, up to date
register of trip and alarm
settings, and that actual
settings correspond with the
register. (Check a few
examples, including devices
that may have been subject to
application of overrides, or
systems that have been
changed recently).
DCR Reg. 7 requires the duty holder to ensure that the installation is not operated unless
appropriate limits within which it is to be operated have been recorded.

A register of trip and alarm settings should be readily

available for each installation.

PUWER Reg. 8 requires employers to ensure that all persons who use work equipment
have adequate health and safety information and, where appropriate, written
instructions.

3.3

Identification of Plant and Equipment

3.3.1

Identification of plant and

equipment on site

Legal
Basis

Process vessels, valves and instruments should be

clearly marked to facilitate identification. Accurate
identification of lines, valves, and equipment is important
to promoting safe isolations. There have been several
Check a few examples of
examples of incidents where the wrong item of
vessels, valves and
equipment has been operated or maintained. Process
instruments on site to verify
theme audits have revealed installations where not all
the adequacy of identification.
relevant items have been marked.
PUWER Reg. 8 requires employers to ensure that all persons who use work equipment
have adequate health and safety information and, where appropriate, written
instructions.
PUWER Reg. 23 places duties on employers to ensure that work equipment is marked in
a clearly visible manner with any marking appropriate for reasons of health and safety.

- 22 -

Item
3.4

Inspection Topics
Operating Procedures

Guidance Notes

3.4.1

Availability of procedures

Operating procedures should be kept up to date, and

there should be systems in place to ensure that process
changes are incorporated. The procedures should be
periodically reviewed for accuracy and completeness.
(Problems with operating procedures being inadequate,
or out of date, have been noted in Theme Audits
conducted by OSD).
Operating procedures should contain clear instructions
for each phase of operation, including initial start up,
normal operation, emergency operations (including
emergency shutdown), normal shutdown, and startup
following emergency shutdown or a turnaround.

Are up to date procedures

available for each section of
the process plant?

3.4.2

Scope of procedures
Do the procedures address
each phase of operation?
(Select a section of plant and
examine the procedures in
detail)

3.4.3

Safety Information

3.4.4

Do the procedures include

reference to safe operating
limits, and actions to take in
response to alarms as the
limits are being approached?
Style / language

Legal
Basis

In addition, operating procedures should be developed

whenever a temporary operation is to be conducted.
In addition to describing the sequence of actions to be
taken, the procedures should describe safe operating
limits, and other safety information related to the
process.

The procedures should be written in language and

terminology clearly understandable to the operators.

Are the procedures in a form

that the operators find
suitable?
PUWER Reg. 8 requires employers to ensure that all persons who use work equipment
have adequate health and safety information and, where appropriate, written
instructions.

3.5

Shift / Crew Change Handovers

3.5.1

Has a standard procedure

been developed for
handovers?
Does the procedure recognise
and make provision for the
high risk situations indicated?
Does the procedure specify
simple steps to improve
communications?
Are crew change handover
notes written in a structured
log format?

Effective communication is particularly important when

responsibility for a task is handed over to another person
or work team. This can occur at shift changeover,
between shift and day workers, or between different
functions within a shift (e.g. operations and
maintenance). High risk situations include:

maintenance carried out across a shift change

deviations from normal working
crew change situations, and
handovers between experienced and inexperienced
staff.

Organisations should have procedures which specify

simple steps to improve communications at shift / crew
change. These include:

carefully specifying what information needs to be

communicated, cutting out the transmission of
unnecessary information
using structured logs or computer displays
ensuring that key information is transmitted both
verbally and in writing, encouraging two way
communication etc.

- 23 -

Item

Inspection Topics

Guidance Notes

Legal
Basis

MHSWR, Reg. 5 requires arrangements for planning and control ... of preventive and
protective measures.
HSWA, s2(2)(c) requires the provision of such information ... as is necessary.
PFEER Reg. 9 requires duty holders to take appropriate measures with a view to
preventing fire and explosion....

3.6

Monitoring of Documentation

3.6.1

What arrangements are there

in place for monitoring (or
auditing) the status of
documentation? including:

MHSWR Reg. 5 requires arrangements for monitoring of

preventive and protective measures.

documentation relating to
as built status
definition of safe operating
limits
protection settings
operating procedures
handover arrangements
plant condition records,
and
control room records.

Legal
Basis

MHSW Regs 1999, Reg. 5 requires arrangements for planning and control and monitoring
of preventive and protective measures.

3.7

Training / Competence

3.7.1

Training for process

personnel
What safety related process
specific training has been
provided for production
personnel?
What training has been given
in control of change
procedures, and hazard
analysis / risk assessment?

3.7.2

Legal
Basis

Process specific training should deal with:

The basic process, design of plant, critical factors which
affect safety, and process safety considerations relating
to flammability, explosivity, toxicity.
Operating procedures, including safe operating limits,
actions to keep within those limits, procedures for start
up, normal operation and shutdown, and contingency
procedures for upsets / emergencies.

Training should also be given as appropriate in

management of change procedures and in techniques
for hazards analysis and risk assessment.
Quality assurance processes, procedures and methods
Competence assurance
should be developed which are designed to ensure the
competence management system consistently achieves
How has competence been
the intended results. Lead bodies such as OPITO set
established / assured for
competence criteria on which qualifications can be
production personnel?
based. The Qualifications and Credit Framework (QCF)
is available for process operators and maintenance
technicians, and many companies have in-house
schemes.
MHSWR places specific requirements on employers to provide information for employees
(Reg. 8), take their employees capabilities into account, and ensure they are provided with
adequate health and safety training (Reg. 10). There is no legal requirement for a specific
competence assurance programme, but such programmes are recognised good practice
(e.g. Oil and Gas UK and E&P Forum Guidelines).

- 24 -

Part 4 - Isolations and permits to work

This section covers isolation standards, locked valve controls, extended term isolations,
isolations for relief and vent systems, permit systems and monitoring arrangements. It is
largely based on HSG 253 The safe isolation of plant and equipment and HSG250 Guidance
on permit-to-work systems.
Item
4.1

Inspection Topics
Guidance Notes
Isolation Standards and Procedures

4.1.1

Have standards and

procedures for isolations been
reviewed / revised against
HSG 253, for safeguarding
against releases from
pressurised systems?
Are offshore responsibilities
clear and adequate planning
arrangements in place?
Are human factors adequately
considered?
Is the isolation selection
procedure based on risk
assessment?
Does implementation offshore
match HSG 253?

HSG253 addresses the need for:

clear identification of plant and equipment

isolation standards to reflect foreseeable risks and
consequences
initial testing of isolations
security of isolation throughout the activity
documentation of the isolation
personnel competent regarding hazards, plant,
procedures and skills. [paras. 49-57].

The guidance describes how roles and responsibilities

are defined, what planning is required, and the
importance of co-operation and communication [47-48].
Incident analysis confirms that human failures cause, or
are involved in, a large proportion of isolation failures.
The performance of isolations depends not only on the
integrity of the isolation hardware, but also on the
adequacy of the arrangements for identifying each
isolation point, securing the isolation, proving/monitoring
and maintaining overall control of work.
Examples of human failures relevant to isolation include:
failure to complete or reverse isolations fully before
starting work or restarting plant;
failure to prove and monitor isolated valves;
poor communication (eg at shift handover); and
failure to check P&IDs/schematic diagrams against
the actual installed plant and equipment.
Appendix 6 of HSG253 describes a risk-based way of
selecting an appropriate method of isolation, based on
situation, substance, pressure, line size, frequency and
duration.
Implementation will normally include:

a local or company-wide procedure [107-108]

isolation for generic operations
a means to assess non-standard and short-term
isolations [128-140]
clear hand-over/renewal procedures
isolation certificates and risk assessments, usually
linked to the permit system [69-86]
a competence assurance programme for users [4957]
monitoring, audit and review procedures [58-66].

- 25 -

Item

Inspection Topics

Guidance Notes

Legal
Basis

HSWA s.2 requires the provision of safe systems of work

MHSWR Reg. 3 requires assessment of risks to health and safety
PFEER Reg. 9 requires safe production, processing, etc. of flammable and explosive
substances, and prevention of their uncontrolled release.
PUWER Reg. 8 requires employers to ensure that all persons who use work equipment
have adequate health and safety information and, where appropriate, written instructions.

4.2

Locked Valve Controls

4.2.1

Are locked valves marked on

diagrams?

Are valves identified, marked

and locked? (small sample to
be checked)

Are keys adequately

controlled?

Is a register available, and is a

checking procedure being
properly used?

Legal
Basis

See 4.1 above

4.3

Extended term isolations

4.3.1

Is a register used?
Is there a procedure for
checking long-term isolations?
Are there arrangements for
periodic review?

Some process valves are specified as locked open or

locked shut, and are marked LO or LC on diagrams.
e.g. open valves on vent and drain lines, and closed
valves on bypasses around ESD or control valves. It is
important that such valves are kept in the correct
position, as they may be a primary means of preventing
high pressure from entering low-pressure plant.
The reason for designating a valve as locked-open or
locked-closed should be known to personnel. Often the
need for locking stems from a HAZOP study or a more
specialised HP/LP interface study. Any changes should
be subject to a formal change procedure.
Valves should be clearly identified by name or number,
on or near the valve, and on diagrams. Valves should be
positively secured so that significant movement is
prevented, for example by mechanical interlock, key
switch or padlock and chain. If keys are used, access to
them should be controlled.
Valve status should be periodically checked, with the
frequency taking into account the potential
consequences of the valve being in the wrong position.
More critical valves, such as any in ESDV vent lines,
should be checked at least monthly. Valves should be
identified on a readily available register, with details of
each valve, its location and status, and the checks
carried out, including the date, the person doing the
checking and the results.

Process equipment may be isolated for extended

periods of time (sometimes permanently) because it is
not commissioned, redundant, only used infrequently or
awaiting repair or modification. Such items can be
hazardous if personnel try to make use of them without
proper re-commissioning procedures.
[HSG 253 paras. 203-205]
The reason for isolation may be forgotten, allowing an
undesirable situation, tolerated on a temporary basis, to
become permanent.
Typical precautions are:

- 26 -

Item

Inspection Topics

Guidance Notes

A register, readily available to personnel, identifying

all long-term isolations and the reasons for isolation
A procedure for checking the status and integrity of
each isolation
A system for periodic review of the status of each
item, to decide if the isolation is still appropriate, if
the plant should be removed, or if other action should
be taken.

Legal
Basis

See 4.1 above

4.4

Isolations for relief and vent systems

4.4.1

Are all valves locked or

interlocked?
Are locks / interlock keys
controlled?
Are operating instructions
available?
Are specification breaks
marked?
Do interlocks cater for
specification breaks?

Relief systems are required to be operational at all times

when the plant being protected is, or is liable to become,
pressurised. Similarly vent lines need to be kept open to
allow a safe path to atmosphere from process
equipment. Isolation valves are undesirable because
they can be left in other than completely open positions.
Often however valves are installed to allow maintenance
to be done on a live system, for example when two relief
valves are used in parallel, one on-line and one off-line.
A system is then required to ensure one valve is always
on line, preferably in the form of mechanical interlocks
on the isolation valves on each relief valve branch.
Locking is also an acceptable standard provided there
are effective procedures to monitor the isolations.
The use of interlock keys should be controlled,
particularly if spare or master keys exist for maintenance
purposes. Authorisation of the use of spare/master keys
by a supervisors signature in a register is
recommended, with a procedure that requires alternative
precautions (such as depressuring the plant) to be
identified and implemented.
Operating instructions for interlock systems should be
available, with personnel trained in their use.
Maintenance of the system is required, as keys and lock
mechanisms can wear and keys can become misplaced.
The pipework downstream of a relief valve may be rated
for a much lower pressure than that upstream, because
it only sees the relatively low back-pressure generated
during blowdown to the open vent or flare. The
specification break is normally at a flange, and should be
marked on a P&I diagram. If the downstream isolation
valve of a relief valve system is to the lower rating, the
interlock should also ensure this valve cannot be closed
when the upstream isolation valve is open. This is
because if the relief valve is passing, full line pressure
can build up on the downstream valve, with a risk of
catastrophic failure.

Legal
Basis

See 4.1 above

4.5

Permit to Work Systems

4.5.1

Is the guidance followed?

Although permit systems are generally effective in

- 27 -

Item

Inspection Topics

Guidance Notes

Are tasks and limits clearly

identified?

controlling risks, weaknesses can occur: This guidance

is based on HSG250, Guidance on permit-to-work
systems.

Are precautions clearly

specified?
Are job-specific factors
considered?
Are risk assessment outputs
used in conjunction with
permits?
Are end-of-shift actions clear?
Is guidance given on
interruptions, or unusual
events?

Task definition HSG250 [paras. 52-56]. The work

required should be clearly identified, if necessary with
specific limitations on what is to be done or not done.
Relevant procedures should be referenced.
Precautions should likewise be specific, and either listed
in detail or reference made to procedures containing the
precautions, which should be readily available and
known to those involved. Phrases such as Take the
usual precautions are not suitable, even for familiar
tasks. Each job should be considered afresh, to identify
any factors that make it different from previous
occasions. Work planning is described in paras. 52-56 of
HSG250, which includes a flow diagram to illustrate the
process.
Risk assessment should be closely linked to permit
systems. This means that a risk assessment should
either be performed at the time the permit is issued, or
available from previous. In either case the output from
the assessment, in terms of the precautions required,
should be transferred to the permit form as actions to be
carried out before the work is started. A list of tick-boxes
on the permit form for the issuing authority to consider
may not be adequate.
Handovers [paras. 23-24]: the permit procedure should
be clear about end-of-shift actions. Permits are
cancelled and re-issued, if required, for the new shift, or
reviewed and endorsed by the new shift supervisor to
allow the work to continue. In either case the procedure
should specify an effective handover from one shift to
the other.
Work interruptions/suspension [paras.19-21]: the permit
procedure should give guidance on the actions to take if
the work is interrupted, such as for a gas alarm. Likewise
the actions to be taken if something unusual crops up
during the work should be described.

Legal
Basis

See 4.1 above

4.6

Monitoring of PTW and isolation procedures

4.6.1

Is formal monitoring of the

PTW and isolation
arrangements undertaken?
Is the content of monitoring
programmes adequate to
ensure satisfactory isolation
standards in practice?

Monitoring is an important part of line management

duties, but may be overlooked because personnel are
considered competent. However, management needs to
know if personnel are working to procedures and
instructions. This type of monitoring should be described
in the SMS.
See paras. 58-68 of HSG253
Monitoring arrangements should include:

Compliance with the company PTW procedure

- 28 -

Item

Inspection Topics

Guidance Notes

Legal
basis

Compliance with the company isolation

procedure
Adequacy of assessment of non-standard
isolations
Locked valve control procedures
Extended term isolations
Relief system isolations, including locks and
interlocks

MHSWR, Reg. 5 places an obligation on employers to monitor preventive and protective

measures.

- 29 -

Part 5 - Process plant protection systems

This part examines the way in which process excursions are prevented from violating the safe
operating envelope of the process equipment. It includes both instrumented protection
systems, and relief and blowdown systems. It is intended for offshore inspection, although in
some cases reference onshore may be required to expand on the initial offshore responses
e.g. aspects of the documentation system.
Item
5.1

Inspection Topics
Guidance Notes
Instrumented protection and ESD systems

5.1.1

Safety Criticality
Are protective functions
identified as safety critical
elements?

Has the safety criticality of

instrumented protective
functions being established
using suitable guidance?

The safety criticality of each instrumented protective

function should be established. EEMUA Guideline to the
Application of IEC 61511 to Safety Instrumented
Systems in the UK Process Industries should be
consulted along with the various parts of EN 61511
Functional safety Safety instrumented systems for the
process industry sector. Another useful document is ISO
10418 Petroleum and natural gas industries Offshore
production installations Basic surface process safety
systems. Application of IEC 61511 to safety
instrumented systems makes use of Safety Integrity
Levels (SILs). The higher the SIL level the more critical
the safety function. Functions designated as 'safety
critical elements', must be identified and verified in
accordance with SCR 19 These typically include trip
systems, fire and gas, HIPS, relief and blowdown
systems.
EN 61508 (Functional safety of electrical / electronic /
programmable electronic safety related systems) Part 5
and EN 61511 Part 3 both discuss the various methods
used to determine SILs. The methods described include
risk graphs, LOPA methods, risk matrices and QRA.

5.1.2

Documentation
Is there documentation
available that identifies
protective functions as SCEs?
Is there further information on
e.g. performance standards,
cause and effects analysis, trip
settings, proof test procedures,
test intervals and test results?

Shutdown systems provide an instrumented means of

protecting plant and equipment from conditions outside
the design basis. By isolating inventories and effecting
blowdown they also provide means for mitigating some
of the hazards arising following loss of containment.
Trip systems provide an instrumented means of
protecting plant and equipment from conditions that
could lead to circumstances outside the design basis.
Trip systems shutdown items of plant when significant
deviations from normal occur.
Documentation should indicate:

which instrumented protective functions have

been designated safety critical elements (SCEs)
the requirements of each protective function
(usually in the form of 'cause and effect charts')
the criticality rating (e.g. SIL)
trip settings (e.g. in a 'trip register')
procedures for proof testing
the required test intervals and results of test
activity.

Experience suggests that all relevant information

- 31 -

Item

5.1.3

Inspection Topics

High integrity functions

Have high integrity functions
been identified?
If so, what arrangements are
in place to ensure that process
safety intent is achieved?

5.1.4

Testing
What arrangements are in
place for testing safety critical
instrumented protection
functions and are they being
followed?

Guidance Notes
including details of the requisite performance standards
may not always be available.
Where no independent mechanical protection (e.g.
pressure relief protection) is provided, an instrument
based protective trip function (e.g. a HIPS system) is an
alternative but requires particularly high integrity. Such
trips are not the preferred protective arrangement, and
need to be engineered with detailed attention to failureto-safety, fault tolerant multiple redundant architecture,
speed of response etc. Note that the use of pressure
switches rather than pressure transmitters is undesirable
on HIPS. The concept of Safety Integrity Levels (SILs) is
now commonly used for instrumented protective
functions, and has largely overtaken the concept of
HIPS.
Examples of such systems have been found where no
detailed response analysis had been carried out, and the
response characteristics were such that the required
performance standards could not be achieved.
All safety critical instrumented protective functions
should be tested at suitable intervals to ensure that their
performance standards continue to be met.
Higher integrity functions require a more stringent test
programme than lower integrity functions. HIPS systems
require regular proof testing, and monitoring of the
demand rate and performance in service.
Typically, testing may be broken down into separate
processes on the sensors, logic and final end elements.
Sensors may be tested quite easily with the logic
inhibited, so are usually tested at intervals of a few
months to 1 year. Testing the logic and end elements
may involve a real plant trip, and is often undertaken
less frequently, typically at two or three times that
interval.
It may be possible to take credit for real or spurious trip
demands, if all the appropriate data are gathered. In any
event, failures in service should be investigated. Trip
testing should check all redundant paths through the
function, including all of the solenoid valves controlling
ESD valves.

5.1.5

Separation of control and

protection functions
Is there separation of these
functions?
Are separate valves used for
control and shutdown

Experience suggests that whilst problems with trip

testing regimes are fairly uncommon, failure to execute
associated testing regimes such as valve closure time,
valve leakage rate etc are more frequent.
Production control functions should be separate from
protective functions in order to avoid common cause
failures e.g. trip tappings should always be independent
of those used for the primary controller to avoid common
cause failure if the tapping line should be blocked or
mechanically isolated. Several examples have been
identified where this was not the case.

- 32 -

Item

Inspection Topics

Guidance Notes

purposes?

Control valves should not be used for dual

control/shutdown purposes because of the potential for
common cause failure and that the fact that control
valves are not designed for tight shut-off.
The action of shutdown and blowdown valves should
preferably be fail-safe. In general, isolation valves should
fail closed and blowdown valves should fail open on loss
of power or control signal. Where valves are not fail-safe
detailed justification should be provided.
Maintenance bypasses around shutdown valves should
be locked closed and shutdown valves should not be
fitted with handwheels.

5.1.6

Actions on utility failure

5.1.7

Do shutdown and blowdown

valves fail-safe on utility
failure?
Isolation issues
Are bypasses around
shutdown valves locked
closed?

Legal
Basis

Valves on hydraulic control system return lines can

cause system failure; these should be locked open.

How are hydraulic systems

checked and monitored?
PFEER Regs. 5, 9 and 12 contain several references to 'measures' being 'appropriate'. A
measure may not be appropriate if its performance capabilities fall short of normal industry
standards. 'Appropriateness' therefore implies some assessment of criticality, and this is
supported by the PFEER concept of a 'written scheme of examination'. SCR 19
establishes the concept of 'safety critical elements' and their verification.

5.2

Control of inhibits / overrides

5.2.1

Inhibit requirements
Have requirements for the
application of inhibits been
adequately defined?
Do inhibits apply to only one
function, or groups of
functions?

Inhibits may be required to allow plant to be started or

maintained. However, protective functions of SIL 3
should not generally be capable of being inhibited, as
the loss of safety functionality is intolerable on live plant.
Facilities such as keyswitches or VDU displays should
be designed into systems to allow controlled application
of inhibits to SIL 1 and SIL 2 functions, and to allow the
operator to check all inhibits in place (and to ensure that
uncontrolled activities on hardwired links within
marshalling cabinets are not used).
Ideally, inhibits should apply to only one function, and
should certainly not apply to large groups of functions.
Where VDU screens are used to apply inhibits the
control room operator should be easily able to locate and
interpret all inhibits that are present. Also where
overrides are applied through VDUs there should be a
keyswitch or password system to prevent inadvertent /
unauthorised application of overrides. If inhibit keys are
used they should be consistent between different panels
(e.g. if right rotation applies on inhibition one panel, the
same should apply on all panels).

5.2.2

Risk assessment
Are inhibits assessed before
being applied?

Where an installation may be controlled from two

different locations (e.g. NUIs) it should be possible at
both locations to check what overrides are in place.
Inhibits should be applied only as part of an established
control procedure. Risk assessment should be included
as part of this process.

- 33 -

Item

Inspection Topics

Guidance Notes

5.2.3

Control and monitoring

Inhibits should be applied for the shortest possible times,

and their continued application should be monitored and
controlled, for example each shift handover. Inhibits
should be removed as part of the process of finishing the
relevant work activity. An 'inhibit log' should be kept
recording the function inhibited, time and date applied, a
cross reference to the relevant permit to work (where
applicable), time and date of each re-assessment, time
and date removed.

Is there a comprehensive
record of all inhibits that have
been applied?
Are they removed when no
longer needed?
Are adequate monitoring
arrangements in place?
If there are two control
locations, is there a proper
protocol in place?

Legal
Basis

The total number of inhibits in place should not be

allowed to grow beyond some manageable limit
(perhaps ~ 10). Monitoring arrangements should verify
the quality of risk assessments, to ensure that when
inhibits are applied they are properly justified.

Where there ares two control locations there should be a

proper handover protocol when control moves from one
location to another.
PFEER Reg. 9 requires the DH to take appropriate measures with a view to preventing
fire and explosion. PFEER Reg. 19 requires that plant provided is maintained in an
efficient state; a protective function that is inhibited may not be efficient.

5.3

Control of programmable systems

5.3.1

Application of
programmable systems

Legal
Basis

Programmable systems may have less predictable

failure modes than non-programmable systems. They
are therefore not necessarily suitable for high SIL
protective functions. It is good practice to separate out
Are high SIL functions
high SIL functions into separate non-programmable
separated out into nonhardware. Programmable systems used in safety related
programmable hardware?
applications should be specifically conceived, designed,
tested and verified for safety applications.
Apparently benign changes to software can have
Software change control
unpredictable effects, so software configuration control
Are software changes
and change control are vital to prevent loss of safety
adequately controlled?
functionality (even at the lower SILs where
programmable systems find most of their applications).
When safety software is being modified onshore, checks
should be made for any changes made offshore which
onshore personnel may not be aware of.
A record should be kept of current software versions and
Documentation
their means of identification, the functional differences
between versions, and interoperability between different
Are adequate records
versions of programmable sub-systems. This record
available for software?
should include all circuit boards and programmable
electronic field devices. The version number records
should include all items held on the installation as
spares.
The PFEER concepts of 'appropriate measures' and 'efficient state' are applicable to the
availability in service programmable systems.

5.4

Alarm system integrity

5.4.1

Design standard

5.3.2

5.3.3

Have alarm systems been

designed or reviewed in
accord with a recognised

Process control equipment usually provides alarm

functions that allow operator intervention; this provides a
useful layer of protection by reducing the demand rate
on formal protective systems. However, the generation
of alarms requires reasonable reliability for the claim of

- 34 -

Item

Inspection Topics

Guidance Notes

standard?

reduced demand rate on formal protective systems to be

credible. Alarm systems should therefore be engineered
in line with an appropriate standard, so that all
appropriate initiating events are identified, and
appropriate equipment is provided to generate those
alarms.
Alarm systems provide a means of warning operators
that plant conditions are deviating significantly from
normal or for alerting operators to take mitigating action
after an incident.
If there are situations on plant where an operator
response to an alarm condition is required to prevent
conditions exceeding the design basis of the plant then
the plant design does not follow the principles of
inherently safer design. In such cases the duty holder
should be required to justify in detail why none of the
inherently safer options is reasonably practicable

5.4.2

Human factors need to be taken into account before any

claim of safety improvements based on response to
alarms can be credible. In particular, alarm floods during
Are there circumstances
where alarms come too fast for process upsets can be so difficult to interpret that the
control room operator can make mistakes or may
operators to take them in?
deliberately violate the official operational procedures.
Process plant is usually fully protected by automatic trips
Are there alarms that
and mechanical devices, so the effect of an alarm flood
operators find are of little
may be to mask critical fire and gas system alarms.
value, and which could be
eliminated?
Two EEMUA guides could be consulted which deal with
Are alarms displayed in logical ergonomic issues relating to alarm presentation /
information overload and the interface with the process
groupings?
operator - 191 Alarm Systems - A Guide to Design,
Management and Procurement (2007) and 201 Process
Is it clear from VDU displays
plant control desks utilising human-computer interfaces:
which items are in alarm?
a guide to design, operational and human-computer
Are the most important alarms interface issues (2010).
clearly identified?
Human factors

Is there a facility to identify first

up alarms?
Is the number of standing
alarms monitored, and
adequately controlled?
If alarm lamps are in use on a
panel is there a lamp test and
do the lamps work?

Legal
Basis

Are there any activated alarms

that have not triggered
appropriate action?
PFEER Reg. 9 requires the duty holder to take appropriate measures with a view to
preventing fire and explosion

- 35 -

Item
5.5

Inspection Topics
Guidance Notes
Relief / blowdown / flare system integrity

5.5.1

Relief and Blowdown

Philosophy
Has the philosophy been
adequately documented?
How is the integrity of phased
blowdown assured?
Is there battery back-up for
phased blowdown logic (i.e.
loss of power should not
interfere with the correct
blowdown phasing).
Have the design of the relief
and blowdown systems been
re-evaluated in the light of any
additions of new equipment or
changed operating conditions?

5.5.2

Relief and Blowdown

System Operations
Are operating procedures
adequately in place for the
relief and blowdown system?
Are purge rates specified, and
applied as specified?
Is this subject to routine
monitoring by operators?

Many of the problems that have occurred on relief and

blowdown systems result from lack of a clear design
philosophy. The philosophy should be adequately
documented. Incompatible fluids should be segregated
(e.g. cold streams / wet streams, or hot streams /
condensate). Piping should be designed to prevent slugs
of liquid accumulating.
A special case occurs when the blowdown system or
flare cannot handle the simultaneous flow from all plant
items being blown down. In this case, a choice is made
(either automatically or by remote manual selection) as
to which plant item is at greatest threat and requires to
be blown down first, with 'phased blowdown' of other
plant some minutes later when the inventory of the first
item has diminished. The control system for phased
blowdown requires suitable integrity; a hazard exists if
the sequence fails and allows too high a blowdown rate.
Relief and blowdown valves/systems are sized for
specific design conditions. If these conditions change
they may not be adequate for the new duty. Conditions
may change either because of plant modifications or
changed operating parameters (e.g. increased water
cut). Several instances have been identified where relief
valve capacity had not been reviewed although the
required duty had changed.
A review of lessons learned from past incidents is given
in Section 6 of Institute of Petroleum Guidelines for the
Safe and Optimum Design of Hydrocarbon Pressure
Relief and Blowdown Systems. This guide includes
checklists for assessment of relief and blowdown
systems [pp 100-102] for both designers and operators.
The guide should be included as part of the inspection
process.
Operators should fully understand how the relief and
blowdown system works, and the key features for
diagnostics.
Operating procedures should contain guidance on
whether to shut down, or continue operating, in all the
circumstances that are likely to be encountered. A plan
of action should be in place for high flare drum level.
Arrangements should be in place to prevent air ingress;
purges on headers should be monitored. On a routine
basis, header drains should be checked to ensure they
are clear and not choked with debris.

- 36 -

Item

Inspection Topics

5.5.3

HP/LP interface studies

Legal
Basis

Guidance Notes

All HP/LP interfaces should be clearly identified and

adequately protected. Protection may be by mechanical
relief or instrumented trips of adequate integrity. In some
Have risks of
situations it may be by procedural or other means to
overpressurisation at HP/LP
prevent overpressurisation, using locked valves, blinds,
interfaces been adequately
restrictor orifices etc. It is generally best to carry out a
assessed, and are they
specific HP/LP interface study, separate from the more
adequately controlled?
routine HAZOP procedure.
PFEER Reg. 9 requires appropriate measures with a view to preventing fire and
explosion. PFEER Reg. 12 requires appropriate measures to limit an emergency,
including remote operation of plant.

- 37 -

Part 6 - Change control

Many of the catastrophic events that have occurred on process facilities are attributable to
changes. There have also been numerous deficiencies in offshore process systems arising
from the failure to control change.
A typical change control problem concerns a failure to re-evaluate relief requirements
adequately when process fluids or operating conditions are changed, or when mechanical
changes are made. Another example involves change from dry gas to wet gas operations. Key
safety issues include different corrosion/erosion rates, liquid slugging effects, increased
pigging frequency, hydrate formation/inhibition, and effects on blowdown, flare and vent
systems.
Duty holders need to have systems to ensure that changes to the process and its equipment,
or to the management system, are properly evaluated before their introduction. This part
reviews the way in which change is initiated, communicated, analysed, implemented, and
reviewed. It involves a mix of onshore and offshore inspection; inspectors will need to decide
on the best place to obtain the relevant information.
It is intended that the guidance should be used flexibly; if it is sufficient to open a meaningful
dialogue then the inspection topics/action will have served its purpose.
Item
6.1

Inspection Topics
Change Control Procedure

Guidance Notes

6.1

Change control procedures

A formal written procedure should ensure that all changes

are assessed for impact on safe process operation. Some
changes will require formal change control, but others will
already have been evaluated for increased risk but will have
been incorporated into the design basis and reflected in the
normal operating procedures.

What procedures are in place

for the identification and control
of changes to process systems?
Do the procedures include the
various aspects required for
effective management of
change?

Legal
Basis

The procedure should identify: Scope of application; Roles

and responsibilities; Risk analysis requirements;
Communication (including notifications); Training;
Implementation; Monitoring and review.
HSWA s2(1) provision and maintenance of plant and safe systems of work that are, . safe
and without risks to health, and s3(1) ensure, that persons not in his employment ....are not
... exposed to risks to their health and safety.

6.2

Scope of Application

6.2.1

Hardware / software
modifications
Does the change control
procedure include:

major plant addition or

modification?
change in process operating
parameter (control, alarm, or
trip setting)?
change in mode of
operation?

A change outwith the design intention should be subject to

change control. Examination of relevant documentation
should reveal the plant design limits, allowable modes of
operation, control and safety system settings etc. Relevant
documentation includes the Basis for Design, Process Flow
Diagram, P&ID, Cause and Effect Diagrams, and Instrument
Information Schedule (list of control, alarm and trip settings),
Process and Mechanical Equipment Specifications,
Hazardous area classification drawings, and Line List.

- 39 -

Item

Inspection Topics

Guidance Notes

6.2.2

Temporary changes

An example of a temporary change is the use of an override

or inhibit on a safety related system. Control of such
changes is normally effected through a separate procedure
for control of overrides / inhibits. However, use of overrides /
inhibits needs to be kept under review, and any changes
e.g. to modify or design out a trip function, should be
handled through the change control procedure.

Does the change control

procedure apply for temporary
changes?
Is there an appropriate
procedure for control of
overrides / inhibits of trip or
other safety-related systems?
6.2.3

Replacement equipment
Does the change control
procedure apply for
replacement of equipment?

6.2.4

Operating procedures
Does it apply for changes to
operating procedures or other
formal operating instructions?

6.2.5

Organisational changes
How are changes to
organisational structures
managed e.g. contractorisation,
downsizing, multi-skilling,
change in shift patterns?

Legal
Basis

Replacement of equipment with non-identical parts or

addition of new equipment (whether for safety-related
purposes or not) will require change control.

Changes to operating procedures should be subject to

change control, unless such changes are within the
established design basis and safe operating envelope.

Mapping of transfer of line management and functional

responsibilities is necessary to prevent gaps e.g. contractorbased production operator fulfilling the new role of Control
Room operator may require further emergency response
training.
Matching of personnel and their skills to the requirements of
the task is necessary for selection, and to identify
outstanding training requirements.

Phasing of change may be necessary for safe transfer from

the old to the new regime. Training needs should be
scheduled, resourced and tracked over a period of time
culminating in an assessment process to assure
competence of production operators.
HSWA ss2(1), 2(2)(a) and s3(1). (See above).

6.3

Roles and Responsibilities

6.3.1

Change initiation

The opportunity for initiating changes should be widely

available to people associated with process systems.

Who can initiate change?

How is it done?

6.3.2

Change approvals
Who approves change?

A description of the proposed change, the date of the

proposal, and the reasons to support it, including health,
safety and welfare issues, are normally recorded on a
purpose-designed document.
Before changes are made, the workforce should be
consulted. This will usually be via the safety representatives
(see guidance document L110 A guide to the Offshore
Installations (Safety Representatives and Safety
Committees) Regulations 1989).
Post-holders who can authorize different types of change
should be clearly identified. The process should involve
personnel with the background and experience to ensure
that changes will not result in operations outside established

- 40 -

Item

6.3.3

Inspection Topics

Guidance Notes

Who else is involved?

safe limits.

Communication

Problems have been experienced where offshore personnel

thought they knew more than they did i.e. there is a need to
involve onshore support for the more significant changes.
Good practice includes provision for feedback on the
reasons why each proposal has or has not been approved.

How is feedback provided to

initiators of change proposals?
6.3.4

Monitoring, Audit and Review

Who is responsible for
monitoring and reviewing the
application of change control
procedures?

There should be clear mechanisms for monitoring

application of the procedure to ensure that it is not shortcircuited or missed out altogether.
Auditing of the SMS, including change control, should be by
independent competent persons (outside the linemanagement chain).

What provision is there for audit

of the application of change
control procedures?
Legal
Basis

HSWA ss2(1) and s3(1). (See above).

6.4

Hazard Identification and Risk Assessment

6.4.1

Hazard Identification
What hazard identification tools
are used?

HAZID is a term that is often used to refer to safety studies

of a brainstorming nature, sometimes driven by
consideration of keywords selected appropriately to the
scope of the study. It is particularly useful for considering
changes to plant layout, and is sometimes used in
conjunction with walk-through methods through existing
plant, or computer-aided virtual plant layout. The aim is to
identify as many potential hazards as possible, for later
assessment.
HAZOP is a systematic method of hazard identification for
the assessment of process systems. If conducted against
well-established guidelines the method brings the benefits
of a multi-discipline team approach prompted by
consideration of deviations from normal process operating
parameters and their consequences. As the name implies
the method is suitable for identifying hazards and also
operability problems.
FMEA, failure modes and effects (criticality) analysis is a
useful method for determining functional redundancy of
protective system elements. It can be used to consider the
effects of removal of layers of protection on process system
integrity.
Fault tree analysis is a technique used to illustrate
graphically the characteristics of protective and other
systems, and may be used to quantitatively model failures
of such systems.
Cause-consequence diagrams are used to graphically
illustrate the range of outcomes that may arise from the
success or failure of a system or its components.

- 41 -

Item

Inspection Topics

Guidance Notes

6.4.2

Risk assessment

Risk assessment must be suitable and sufficient. Where

hazards are identified, the risks may be assessed
qualitatively or quantitatively. For most change control
applications risk will be evaluated qualitatively using some
sort of risk matrix. Where risks are computed numerically it
is necessary to have a performance standard by which
suitable comparisons of benefit vs. risk may be made. This
may take the form of an implied cost of avoiding a fatality. If
the risks are found to be intolerable and can not be
reduced, then the change must not be implemented.

How are risks arising from

change assessed?
Are practicable measures to
reduce the risks to a tolerable
level considered?

Legal
Basis

Risk assessments can sometimes become mechanistic and

superficial. Line management should monitor the quality of
risk assessment, and the implementation of prescribed
control measures.
MHSWR Reg. 3, suitable and sufficient assessment of the risk ... and that any such
assessment shall be reviewed if there is a reason to suspect that it is no longer valid or
there has been a significant change in the matter to which it relates.

6.5

Implementation and Follow-Up

6.5.1

Actions from Risk

Assessment etc.

Actions from HAZID, HAZOP etc. should be summarized for

tracking implementation in the as-built modification.

6.5.2

How does the procedure ensure

that actions identified during risk
assessment are implemented?
Documentation

Legal
Basis

How is document updating

managed following change?
MHSWR Reg. 5, planning, organisation, control, monitoring and review of preventive and
protective measures

6.6

Safety Case / Verification

6.6.1

Safety Case change

notification
How is a change to the safety
case identified and initiated?

The document control system should ensure that updated

documents are available to personnel and that outdated
documents are withdrawn from circulation.

Even apparently minor changes to the safety case (SC)

should be assessed and logged, and all relevant
documentation updated. The SC should be revised
periodically to incorporate relevant changes.
Material changes to the SC require submission to HSE 3
months prior to implementation. Material changes may
include:

modifications or repairs to the structure of any plant

where the changes may have a major impact on safety
new activities on the installation or in connection with it
changes of operator or ownership or other
circumstances involving changes in the management
arrangements
remedial measures resulting from an accident or incident
investigation, or safety management system audit
implementation of novel technology.

- 42 -

Item

Inspection Topics

Guidance Notes

6.6.2

Implications for PFEER / DCR /

verification

The duty holder is required to repeat PFEER risk

assessments as appropriate.

How are potential changes to

the PFEER assessment
considered?

The DH is required to operate a suitable written scheme of

examination (PFEER Reg. 19) and verification scheme
(SCR Reg. 21)

How is the ICP notified of

changes to SCEs, and how are
these examined / verified by the
ICP?
Legal
Basis

SCR Reg. 14 require the revision of the contents of the SC as often as may be appropriate
and/or where revision will render the SC materially different.
SCR Regs. 20 & 21 review, revision, and continuing effect of verification scheme
PFEER Reg. 5(1) assessment to be performed and repeated as often as may be appropriate
PFEER Reg. 19(2) & (3) operation of a suitable written scheme of examination

6.7

Operational Risk Management and Assessment

6.7.1

Introduction to Operational
Risk Assessment
Is the duty holder using
Operational Risk Assessment
on the installation?

6.7.2

Operational Risk Assessment

Process

Operational Risk Management (ORM) is concerned with the

determination and management of the measures necessary
for continued operations where failure of a process, plant,
equipment or procedure has the potential to adversely affect
the risk profile of the installation at any level of operation.
Operational risk assessment (ORA) is an integral part of
ORM. ORAs are considered to be a deviation from an
installations design intent and as such provide an indication
of where the design and/or design intent may be flawed,
plant is not adequately maintained or is used outside of its
normal operating envelope or design parameters. It is
essential that ORAs are produced, verified, controlled,
applied, monitored, audited and liquidated to the highest
standards.
The following seven steps comprise a typical operational
risk assessment process.

1.
Recognise the need
2.
Identify the Hazard
3.
Assess the Risk
4.
Analyze Risk Control Measures
5.
Make Control Decisions
6.
Implement Risk Control Measures
7.
Monitor and Review
Operational Risk Management There are many desired outputs from the ORA:
1)
a decision as to whether the offshore team is
suitably qualified to conduct the ORA in all of the
Is the duty holder getting the
circumstances, and if not to supplement the team;
desired outputs from the
2)
identification of cumulative effects which have a
Operational Risk Assessment?
bearing on the situation e.g. number of impaired barriers to
prevent or mitigate a major accident;
3)
identification of practicable interim additional barriers
to supplement those of the design;
4)
identification of suitable interim/special emergency
response arrangements;
Is the duty holder using a
suitable Operational Risk
Assessment Process?

6.7.3

- 43 -

Item

Inspection Topics

Guidance Notes
5)
an estimate of time scale for the barrier/barriers to
be restored;
6)
an assessment of the residual risk;
7)
according to the residual risk, consideration of the
level of authority required to proceed;
8)
a decision that the residual risk is tolerable or not for
the proposed timescale, and taking the appropriate action
i.e. continue production with the additional measures or shut
down all or part of the process plant;
9)
audit and review periodically to ensure no further
degraded situations have arisen, and that the time for
restoration of the barrier/barriers has not slipped.

6.7.4

The number of live operational risk assessments should be

low, as their presence indicates that the installation is not
Does the duty holder show good well maintained and is used outside its operating envelope
or design parameters.
operational risk management
practice?
The time at risk should be as short as reasonably
practicable.
Good Practice

The duty holder should review operational risk assessments

periodically to ensure that lessons are learned.

- 44 -

Part 7 - Maintenance and verification of process safety-critical

elements
This part examines the way in which process safety critical elements are managed. OSDs
analysis of incidents indicates that particular attention needs to be given to systems for
managing corrosion & erosion, and leaks at flanges. It involves a mix of onshore and offshore
inspection. Guidance is available which sets out various recommendations for industry to
follow: e.g. HS007 Guidelines for the management of safety critical elements, EI / Oil and Gas
UK (2007), Fire and Explosion Hazard Management, part of HS025 Fire and Explosion
Guidance, Oil and Gas UK / HSE (2007) and HS015 Guidelines for the management of
integrity of bolted joints in pressurised systems, EI / Oil and Gas UK (2007).
Item
7.1

Inspection Topics
Guidance Notes
Process safety critical elements (SCEs)

7.1.1

Identification of SCEs
Have industry guidelines on
identification of SCEs been
followed, and do they include
those referenced opposite?

SCEs relevant to preventing hydrocarbon releases include

the following systems:

Are there any unexpected

omissions from the SCE list?

7.1.2

Performance standards
Are performance standards
measurable / auditable?
Has an independent competent
person reviewed them?

7.1.3

7.1.4

Hydrocarbon containment envelope: e.g. vessels &

pipework, rotating machinery, risers, pipelines,
corrosion protection systems, etc.
ESD system including HIPS: e.g. initiating devices,
cabling, logic systems and software, control room
panels and displays, emergency power supplies,
process and riser ESDVs, SSIVs, and associated
equipment, HIP systems, etc.
Relief, blowdown, flare and vent: e.g. relief valves,
blowdown systems, pipework and supports, knock out
vessels and supports, flare or vent tower / boom etc.
SCEs that are sometimes overlooked include, for
example, temporary equipment, and software
controlling compressor and turbine overspeed
protection.

Except for PFEER SCEs, performance standards are not

an explicit requirement of the regulations. However, the
requirement to verify the suitability of elements means that
there must be some recognised criteria by which suitability
may be judged. Such criteria include both functional
requirements and the integrity level needed to control risks
adequately. Performance standards should:

How have the comments of the

ICP been addressed?

Integrity assurance for SCEs

Planned maintenance routines should provide appropriate

checks on the specified performance standards.

Is there an adequate testing

regime in support of SCE
performance standards?
Verification of SCE
performance standards
How is verification of
performance standards

record the essential features of SCEs

set measurable goals that each SCE is to achieve
specify the nature / frequency of examination / testing
address the initial and continuing suitability of SCEs.

The verification scheme needs to examine and test the

effectiveness of safety-critical elements. The DH should
have arrangements to deal with failure of a SCE to meet
its performance standard. These might include:

- 45 -

Item

Inspection Topics

Guidance Notes

undertaken?

How are failures in performance

addressed?

Are the relevant verification

documents available at the
nominated UK address?
Are changes to SCEs subject to
formal change control, and ICP
involvement?

identifying responsible person to be notified

undertaking an assessment of significance of nonconformity with safety case risk assessment
record assessment and tracking actions to close-out.
Documentation should be held at a nominated UK
address, and should include:
verification schedules
written schemes of verification
ICP record sheets
ICP reservations

Legal
Basis

Changes to SCEs require use of the duty holders change

control procedure and referral to the ICP for comment.
SCR Regs.19, 20 & 21 require a verification scheme to be put into effect to verify that SCEs
are suitable, and that they remain in good repair and condition. These requirements are also
partly covered by PFEER Reg. 9 (2). The ACOP (L65) states that setting performance
standards for measures is a crucial aspect of the assessment process.

7.2

Control of corrosion and erosion

7.2.1

Corrosion policy

A corrosion management policy should:

What corrosion management

policies are in place?

7.2.2

Organisation

7.2.3

Have roles / responsibilities for

corrosion and line managers
been adequately defined?
Planning and implementing

The roles and responsibilities of Operator, engineering

contractor and inspection company staff in connection with
corrosion management should be clearly defined.

What is the status of corrosion

control plans / strategies, and
performance standards?
How are the various corrosion
control measures implemented
on site?

Evaluation of both the corrosion control and corrosion

monitoring / inspection aspects is required. The following
are key elements of a good corrosion management plan:

7.2.4

be clear and understandable

demonstrate management commitment
lay down performance targets
address pipelines and topsides in an integrated
approach

Identification of corrosion mechanisms and the affected

equipment under normal and abnormal operating
conditions
Risk assessment to establish equipment criticality, and
to guide corrosion control / monitoring arrangements
Corrosion control systems to prevent or reduce
material degradation i.e. corrosion inhibition, protective
coatings, extra wall thickness (corrosion allowance)
Corrosion monitoring, consisting of data gathering,
data analysis and data assessment
Corrosion acceptance standards
Feedback mechanism.

Performance monitoring

Some of the proactive monitoring measures include:

How is performance monitored

against predetermined criteria?

checking amount of inhibitor used

regular checks on data gathering activities
opportunistic inspection
monitoring of corrosion rates and incident rates
checks on quality of inspection reports
examination of the status of corrosion probes

- 46 -

Item

Inspection Topics

Guidance Notes

7.2.5

Audit and Review

What arrangements are in place
to review the corrosion
management system?

coupons and data storage equipment

checks on data from on-line monitoring probes
supervision of non destructive inspection activities
checks on protective coatings.

(Note: Performance monitoring of corrosion management

systems has often tended to be limited)
Review should include evaluation of the effectiveness of
existing equipment and techniques, and an evaluation of
the benefits to be gained by adopting newer equipment
and improved techniques.
Periodic audits should be carried out.

What audits of the corrosion /

erosion management system
have been undertaken?

7.2.6

Have recommendations arising

from audits and reviews been
implemented?
Offshore Implementation
Is the corrosion management
strategy effectively enacted
offshore?

Aspects for consideration during offshore inspection

include:

Legal
Basis

the potential for under lagging corrosion, and how this

is managed
extent of undesirable corrosion initiating design
features such as dead legs, masked areas etc.
the distribution of small bore pipe work and the
condition monitoring regime
condition of flange bolts
location of monitoring probes and wall thickness
monitoring areas
maintenance of corrosion inhibitor injection equipment,
and its availability
corrosion knowledge and responsibilities of offshore
staff
actions to raise awareness of corrosion amongst the
offshore operations staff
corrosion incidents and remedial actions
actions to achieve continuous improvement and a
reduction in leak rates.

PFEER Reg. 9 requires duty holders to take appropriate measures for preventing the
uncontrolled release of flammable etc substances.
PUWER Reg. 5 requires the maintenance of work equipment in an efficient state.
MHSWR Reg. 5 requires arrangements for planning and control ... of preventive and
protective measures.

7.3

Pump and compressor seal integrity

7.3.1

Have there been any significant

deviations in the process fluids,
or operating conditions,
compared with those specified?

Many seal system failure incidents in compressors and

pumps can be attributed to deviations from the process
fluid specification, or deviation from design operating
conditions, or the after effects of maintenance intervention

Are adequate monitoring

arrangements in place for seal
systems, including flow rates,

Maintenance arrangements should address the required

training and competency of personnel refitting seals.

- 47 -

Item

Inspection Topics

Guidance Notes

pressures and temperatures?

Is competence of maintenance
personnel adequately assured?

Legal
Basis

Have actions from any seal

failure incidents been
implemented?
PUWER Reg. 5 requires the maintenance of work equipment in an efficient state.
PFEER Reg. 9 requires duty holders to take appropriate measures for preventing the
uncontrolled release of flammable etc substances.

7.4

Management Systems for Flange Joints

7.4.1

Overview

Have the management

arrangements been reviewed
against the latest bolted joint
guidelines or has the DH other
guidelines to work to?

The duty holder should ensure that the integrity of Bolted

Pipe joints over the whole life of the plant is addressed
within the management system. This should be achieved
as a matter of management policy by specifically
identifying management of bolted pipe joints within the
engineering design, construction, maintenance and
operation standards and procedures. An inspection of this
topic should include reference to the latest industry bolted
joint guidelines; inspectors should therefore take a copy
with them offshore.
The integrity of joints and seals is important as failure
could lead to a release of hydrocarbons. Flanges and
other joints should be adequately designed and properly
made to avoid flammable and toxic hazards.

7.4.2

Responsibilities
Are responsibilities /
accountabilities adequately
defined for management of
bolted pipe joints?

7.4.3

Training and Competence

How is competence
established/assured?
Is there a register of competent
persons?
How is the competence of
vendors addressed?

The guidelines state that there should be an identified

owner of the management system, responsible not only for
its implementation and ongoing maintenance, but also for
communicating its aims and objectives throughout the
organisation. The owner should state the expectation for
the system and monitor its effectiveness.
According to the guidelines training and competence is
one of the key elements of joint integrity management.
The duty holder should have a formal competence
assurance scheme, which ensures that all personnel
(company and contractor) who are required to work on
bolted pipe joints are formally assessed as being
competent to work with such connections. The scheme
should cover the range and task skills appropriate for
bolted pipe joints.
The DH should ensure long-term retention of competence
by periodic reassessment of personnel. Personnel
assessed as being competent should be registered as
being Authorized to carry out the range of tasks in which
they have been assessed as being competent. A register
of competent personnel should be kept.
Management procedures should ensure that Vendor
personnel employed on short term construction or
maintenance work are competent to carry out such work
and it is recommended that their competence is recorded

- 48 -

Item

Inspection Topics

7.4.4

Verification of bolted pipe

joints

Legal
Basis

Guidance Notes

in the register of authorized personnel.

The verification scheme should provide assurance that the
integrity of critical bolted pipe joints is maintained to very
high level. This should include the competence of fitters,
checking/testing the joint after make-up, and inspection
Is the integrity of critical flange
and maintenance routines.
joints adequately verified?
PFEER Reg. 9 requires duty holders to take appropriate measures for preventing the
uncontrolled release of flammable etc substances. PUWER Reg. 5 requires the maintenance
of work equipment in an efficient state. PUWER Reg. 8 requires ensure that persons who
use work equipment have adequate health and safety information and, where appropriate,
written instructions.

7.5

Review of ageing plant against current standards

7.5.1

Review of older installations

Legal
Basis

Older installations were often designed to standards that

have since been superseded. For example, a number of
older offshore installations have threaded pipe
Has the installation been
connections on hydrocarbon systems. Piping codes such
reviewed against current
as ANSI B31.3 would now only allow their usage under
standards (if applicable)?
very restricted circumstances. Duty holders should have
arrangements to review older facilities against current
Have improvements to
standards, to determine whether upgrades would be
mechanical system integrity
been implemented as a result of reasonably practicable. A cost-benefit analysis may be
used to determine if potential improvements are
reviews?
reasonably practicable.
HSWA s2(2)(c) requires the provision of such information, ....as is necessary to ensure, so far
as is reasonably practicable, the health and safety of employees.
PUWER Reg. 5 requires the maintenance of work equipment in an efficient state.
MHSWR Reg. 5 requires an organisational structure to provide for progressive improvement
in health and safety.

- 49 -

Part 8 - Control of miscellaneous process hazards

This part reviews the way in which some miscellaneous process hazards are managed. Not all
the hazards are relevant to every installation, and the notes concentrate on preventive controls
rather than loss of containment etc.

8.1 Control of H2S and CO2

Gas streams associated with some reservoirs have to be treated to reduce the Carbon Dioxide
(CO2) or Hydrogen Sulphide (H2S) to levels to meet export pipeline gas specifications. Two
main methods are used, these are a) counter-current contact in which the gas stream rises
through a column against a downward flowing stream of amine or proprietary solvent, and b)
absorption, where the gas stream may be passed through a column packed with zinc oxide in
powder or granular form

8.2 Sand management

Production of sand with well fluids presents several potential hazards for topsides pipework
and equipment, for example:

Sand plugging causes valves to seize, potentially compromising ESD action.

Accumulated sand requires operator intervention to remove it, by sand-washing, digging
out, or dismantling of plate exchangers.
Sand accumulation can prevent corrosion inhibitor reaching the material surface leading to
increased corrosion.
Sand accumulation in level instruments and bridles can lead to false readings and poor
control, and may compromise shutdown initiation.

8.3 Control of hydrates

Hydrates are ice-like solids that can form when wet gas and light condensate at high pressures
cools to lower temperatures. Hydrates are formed by gas cooling to below its water dew point,
or when free water is present. Cooling may be due to operational pressure drop, or during
start-up when hydrocarbon is introduced into cold pipework or equipment. Once formed
hydrates are difficult to remove; prevention is better than cure. Hydrate inhibitor, such as
glycol, methanol or industrial methylated spirits, is used to inhibit the formation of hydrates, by
removal of free water. Hazards caused by hydrates include:

Blockage of pipework, and instrument tappings, causing false readings.

Plugging of valves, giving operational problems, and potentially compromising ESD action.
Hydrate particles travelling at high gas velocities can cause large forces at elbows and tees.
Removal of hydrates may require physical intervention, with associated risks. Sand
particles can erode piping and fittings, particularly chokes and flowlines,

8.4 Sampling arrangements

Sampling involves directly breaking into the hydrocarbon containment envelope. Hazards
associated with potential loss of containment, and static electricity, should be recognised.

8.5 Protection against air ingress and flammable mixtures in process plant
Flammable mixtures can form in piping, plant and equipment when air enters systems that
normally contain hydrocarbon, as a result of operational or maintenance activities. Correct
purging and operational procedures will ensure that the risks are minimised.

- 51 -

8.6 Segregation of hazardous drains

Open drain systems are typically classified as hazardous and non-hazardous. It is important
that segregation of the drain systems is maintained at all times to prevent migration of
hydrocarbons into safe areas where they may present an ignition risk.
Item

Inspection Topics

8.1

Control of H2S and CO2

Guidance Notes

Note: Hydrogen Sulphide is a highly toxic gas, and adequate precautions have to be in place
to deal with toxic hazards. However, this inspection project focuses primarily on prevention of
loss of containment, not on dealing with the consequences.
8.1.1

Risk Assessment / Incidents

Are risks, arising from the
presence of H2S or CO2 in process
fluids, significant?

8.1.2

Have there been any incidents

arising from presence of H2S or
CO2?
Operating Procedures
Are duty holder procedures and
systems for the control of H2S
based on recognised codes and
standards?

Risks arising from presence of H2S and / or CO2 should

have been assessed, and appropriate controls put in
place.

API RP 55 - Conducting Oil and Gas Producing and

Gas Processing Plant Operations Involving Hydrogen
Sulphide covers recommendations for protection of
employees as well as conducting oil and gas processing
plant operations where hydrogen sulphide is present in
the fluids. The recommended practices should be
reflected in the duty holders procedures and systems.
Procedures should explicitly mention the hazards of H2S
and how the plant is managed to address these hazards.
Operating procedures should include:

8.1.3

Integrity monitoring
Is the integrity of the H2S & CO2
plant adequately maintained?
Was the plant designed, and is it
inspected, to ANSI M fluid
service code requirements?

Actions to keep within safe operating limits, and the

consequences of failing to do so
Start up, normal operation and shutdown
Contingencies for upsets / emergencies.
H2S & CO2 form corrosive acidic solutions in the
presence of water. In view of the hazardous and toxic
nature of these gases maintaining the integrity of the
plant is essential. An effective system should be in place
to monitor the condition of pipework and equipment.
Repairs and replacement of plant must be to a suitable
standard (e.g. the NACE standard for equipment
containing H2S)
If a process fluid contains H2S, according to ANSI B 31.3
it might be categorised as 'M fluid service'. The definition
of 'M fluid service' is "A fluid service in which the
potential for personnel exposure is judged to be
significant and in which a single exposure to a very small
quantity of a toxic fluid, caused by leakage, can produce
serious irreversible harm to person on breathing or
bodily contact, even when prompt restorative measure
are taken." The Code puts extra requirement for the
system design, fabrication and inspection etc. for
systems containing 'M' fluid.

- 52 -

Item

Inspection Topics

Guidance Notes

Legal
Basis

MHSWR Reg. 5 requires arrangements for planning and control ... of preventive and
protective measures.
PUWER Reg. 8 requires adequate health and safety information and, where appropriate,
written instructions.
PFEER Reg. 9 requires appropriate measures for preventing the uncontrolled release of
flammable etc substances.

8.2

Sand management

8.2.1

Risk Assessment / Incidents

Risks arising from presence of sand should have been

assessed, and appropriate controls put in place.

Are there significant risks arising

from sand production?

8.2.2

Have there been any incidents

arising from presence of sand?
Sand management strategy
Is there an adequate sand
management strategy in place?

Sand management strategies may aim to prevent sand

production, or may rely on monitoring to avoid loss of
containment. The following elements should be included:

8.2.3

Sand management organisation

Are there systems in place for
management of sand production?
Is integrity monitoring of
vulnerable pipework and systems
undertaken?

Effective systems should be in place, onshore and

offshore, for the management of sand production, e.g.

8.2.4

A policy or strategy statement

Arrangements for assessment of sand-related
hazards
A reservoir management strategy for sand control
Sharing of experience of sand problems with others.

If the sand management strategy allows some sand

production, limits on sand production should be set
Lesson learned from flowline inspection programmes
should be captured
Operating conditions, particularly fluid velocity,
should be optimised to minimise erosion
Wall thickness checks, of critical areas of pipework,
should be undertaken
The verification body should verify the effectiveness
of the sand management strategy.

Sand monitoring

If sand monitoring systems are provided:

Are adequate arrangements for

sand monitoring in place?

Are the results from sand

monitoring properly used?

The philosophy for sand monitoring should be clear,

i.e. is it alarms only, periodic measurement, or
continuous monitoring?
Sand monitoring instruments should be calibrated.
Trending the results should facilitate deterioration
over time to be measured
If results from one instrument are used to infer
conditions in other places, (e.g. monitoring on one
flowline used to infer conditions in other flowlines),
the validity of the assumptions used should be robust
Appropriate actions should be taken if alarm limits
are exceeded.

- 53 -

Item

Inspection Topics

Guidance Notes

8.2.5

Operating procedures

Operators should be aware of the hazards associated

with sand production and the limits of individual wells
and operating plant. Operating procedures may include:

Are there adequate operating

procedures for control of sand
production?
Are operators aware of the
limitations imposed by sand
production?

Restrictions on the operation of individual wells or

systems
Control of the operation of chokes to avoid settings
where erosion may occur
Procedures for removal of sand from vessels, etc.

Legal
Basis

DCR Reg. 14 requires the well-operator to assess the well conditions, and any hazards
PFEER Reg. 9 requires duty holders to take appropriate measures for preventing the
uncontrolled release of flammable etc substances.
PUWER Reg. 5 requires the maintenance of work equipment in an efficient state.

8.3

Control of Hydrates

8.3.1

Risk assessment / incidents

Is there a proper awareness of the
hazards associated with hydrates
and hydrate inhibition systems?
Have there been any hydraterelated incidents?

8.3.2

Procedures
Do procedures cover hydrate
hazards, and the arrangements for
prevention and control?

8.3.3

Provision of inhibitor
Are operators aware of the
requirement for inhibitor during all
operating modes?
Is hydrate inhibitor injection
provided at all necessary points
on the installation?

If hydrates form there may be large slug forces at bends

and tees in piping systems. There are also hazards
associated with methanol injection into wells and
flowlines, where pressures may be >100 bar.
The potential for hydrate formation under non-routine
activities should be addressed.
Hazards associated with hydrate formation should be
specifically addressed in operating procedures.
Procedures should include:

Actions to keep within safe limits by preventing

hydrate formation, and the consequences of failing to
do so
Procedures for start up, normal operation and
shutdown
Contingency procedures e.g. for situations where
hydrate formation is suspected, or where the supply
of inhibitor is interrupted.
Once formed hydrates are difficult to get rid of, it is
therefore essential for inhibitor injection to be started
before hydrocarbon flows are started.
Inhibitors are frequently injected temporarily on start up,
when high-pressure drops occur and pipework and
equipment may be cold. Depending on the conditions
the injection may be discontinued when the process
reaches steady state conditions.
Hydrate inhibitor may be injected at a rate proportional to
the hydrocarbon flowrate. Tables or charts of well
flowrate versus inhibitor injection rate will enable
operators to set appropriate rates.
It is essential that the hydrate inhibitor is present at the
point where gas / condensate is cooled to its hydrate
formation temperature. Therefore injection is upstream
of control valves, choke valves or any place where
pressure reduction takes place.

- 54 -

Item

Inspection Topics

Guidance Notes

Legal
Basis

MHSWR Reg. 5 requires arrangements for planning and control ... of preventive and
protective measures.
DCR Reg. 7 require the duty holder to ensure that the installation is not operated unless
appropriate limits within which it is to be operated have been recorded.
PUWER Reg. 8 requires employers to ensure that all persons who use work equipment have
available to them adequate health and safety information and, where appropriate, written
instructions.

8.4

Sampling arrangements

8.4.1

Risk assessment / procedures /

incidents
Has risk assessment of sampling
activities been undertaken?
Are sampling activities covered by
operating procedures?
Are precautions adequately
specified and implemented?
Have there been any examples of
loss of containment from sampling
activities?
Are only designated sample points
used for taking samples?
Are sample points designed to
minimise the possibility of
hydrocarbon release?

The hazards associated with breaking into the

hydrocarbon containment envelope should be
specifically addressed in procedures for interventions
into the process plant. Operating procedures should
include:

Techniques for sampling all the likely fluids

All the types of sample connection in use
Precautions to be taken during sampling
Contingency procedures for upsets / emergencies.

Only properly designed and designated sample points

should be used for taking samples. Serious incidents,
involving loss of containment, have occurred where
unofficial connections have been used for sampling.
Closed bomb sample loops may be used in preference
to open sample vessels. Specifications should be
available for pressure ratings, etc. for sample bombs.
There should be a system in place to assure the integrity
of the pressure containing sampling equipment.

Has the plant been critically

reviewed to remove redundant
sample points?

8.4.2

Are suitable vessels used for

collecting samples?
Static electricity hazards
Is the plant designed to minimise
effects of static electricity during
sampling, and is this reflected in
sampling procedures?
Are precautions based on
recognised practices (NFPA, BS
5958), and are they applied in
practice?

For open sample connections the design of the system

should prevent the accumulation of any static electrical
charge, for example, by the avoidance of non-conducting
surfaces and the bonding of metal parts. Efficient static
bonding connectors should be provided.
NFPA Recommended Practices Manual Vol 9 Section
77 recommends that containers of more than 5 gal (19
litre) capacity made of non-conducting materials should
not be used without special precautions. BS 5958 Part 2,
para 12.4.4 notes that when a liquid of low conductivity
is being handled, and various other specified
precautions are applied, a small electrostatic charge
may remain, but it is common practice to use high
resistivity containers with capacities up to 5 litres.
Other precautions referred to in BS 5958 Part 2 include

- 55 -

Item

Legal
Basis

Inspection Topics

Guidance Notes

earthing of conducting components and adjacent

objects, limitations on filling rate, avoiding rubbing the
external surface of the container, and ensuring that
personnel in the vicinity of the container do not present
an ignition risk.
PUWER Reg. 5 requires the maintenance of work equipment in an efficient state.
PUWER Reg. 8 requires adequate health and safety information and, where appropriate,
written instructions.

8.5

Air ingress / flammable mixtures in process plant

8.5.1

Flare and vent purging

Are adequate precautions taken to
prevent air ingress into the flare
and vent systems?
Have recognised methods been
used to determine the required
purge rates?
Are alternative supplies available?

Purging of flare and vent headers is required to prevent

air ingress, which could lead to a flammable mixture
forming in the system. Purge rates may vary depending
on the operating mode. If there are sufficient continuous
and incidental discharges from the process into the flare
system a minimum purge rate may be acceptable. Purge
points should be located at the upstream end of headers
to ensure that there are no dead ends.
Several methods are available to calculate required
purge rates, e.g. Husa (1964 updated 1977) - based on
achieving a max 6% O2 25ft from an open vent stack,
Tan (1967) or Cochrane & Paterson (1995).
Alternative supplies of purge gas (e.g. nitrogen, fuel gas
or propane) should be available, and used when the
normal supply is not available.

8.5.2

Vessel purging
Are adequate purge rates
maintained at all times to prevent
air being drawn into process
vessels?

Fuel gas or nitrogen may be provided to some tanks and

vessels to maintain system pressurisation, allow for
expansion/contraction or to exclude air to prevent
formation of an explosive atmosphere or to prevent
chemical degradation. Vessels may include:

8.5.3

Maintenance purging
Do procedures cover the
precautions taken to minimise the
formation of flammable
atmospheres within systems
following maintenance or routine
operations?
How is the adequacy of purging
determined?

methanol or glycol storage tanks

cooling / heating medium expansion vessels
open / closed drains tanks etc.

(Note: inert gas blanketing of FPSO cargo tanks is

covered in Part 9 of this project).
Procedures for maintenance intervention, and for
restoring equipment back into service, should address
the control of any flammable atmosphere that may be
formed. Purging with nitrogen, or other inert gas, prior to
intervention, or restoring equipment back into service,
will minimise the flammable atmosphere.
Following maintenance, sampling of the inert
atmosphere should be undertaken to ensure that the
oxygen content is less than a specified amount (typically
<5% O2).
For interventions that are carried out routinely, e.g. pig
traps, dedicated arrangements for purging and venting
should be provided.

- 56 -

Item

8.5.4

Legal
Basis

Inspection Topics

Guidance Notes

If tanks or caissons are opened for maintenance from

which hydrocarbon cannot be fully removed special
precautions may be necessary (e.g. continuous purging
or foam blanketing).
If
nitrogen is produced on the installation using a
Other hazards
nitrogen generation plant the quality of the nitrogen
should be assured. Of particular concern would be high
levels of oxygen in the inert product gas.
MHSWR Reg. 5 requires arrangements for planning and control ... of preventive and
protective measures.
PFEER Reg. 9 requires duty holders to take appropriate measures with a view to preventing
fire and explosion....

8.6

Segregation of hazardous drains

8.6.1

Integrity of segregation

Are routine inspections carried

out?

Seal pots and seal loops in the drain headers are used
to provide segregation between drain systems. Seal pots
and loop seals can either rely on a continuous or a
dedicated water supply, which should maintain all seals
liquid full. Routine plant inspections should include
checking that seals are intact and that no debris has
collected to block drains or gullies.

Is the integrity of lute seals

adequately maintained?

Vents or siphon breakers should be provided at vertical

falls to prevent liquid being siphoned out of the seal.

Are seal pots and loop seals

maintained liquid full?

Segregation of the drains systems is also necessary at

the drains caisson. Dip pipes for the non-hazardous
drains should be lower than those for the hazardous
drains, to prevent migration of gas. The integrity of the
dip pipes should be assured. (The dip pipes may have
corroded off or perforated at or above the water line).

8.6.2

Other considerations
Has winterisation been
considered?
Have effects of modifications been
considered?

Legal
Basis

Lute seals (U bends) may also be provided on drains

tanks, bulk storage tanks, tanks in columns and crane
pedestals. These provide a liquid seal to prevent
migration of gas between systems. The integrity of these
seals should be maintained.
Winterisation of drain lines (particularly across bridges)
and seal loops may be provided to prevent blockage.
Winterisation should be maintained in good condition,
and its effectiveness assured.
The implications on the drain systems of any changes to
the area classification of the installation should have
been addressed, e.g. an area with new equipment
redesignated as Zone 1 or 2 yet still drained by a nonhazardous drain.

PFEER Reg. 9 requires duty holders to take appropriate measures for preventing the
uncontrolled release of flammable etc substances.
PUWER Reg. 5 requires the maintenance of work equipment in an efficient state.

- 57 -

Part 9 - FPSO specific systems

This part reviews factors that are specific to FPSOs and, in some cases, floating production
platforms, i.e. semi-subs. and tension leg platforms (TLPs).
Item
9.1

Inspection Topics
Guidance Notes
Effects of Motion on Process Plant Systems

9.1.1

Operating Envelope
Is the operating envelope clearly
defined?

9.1.2

Flare & Relief System Design

Is the flare and relief system
designed, and the vessel
operated, to avoid accumulation of
liquids downstream of relief
devices?

9.1.3

Procedures / Instructions
Are there instructions on action to
take when operating limits are
reached?
Are instructions adhered to? Have
inhibits / overrides been applied to
avoid tripping due to vessel
motion?

Legal
Basis

Wave-induced vessel movement can significantly affect

the performance of process equipment. The equipment
will normally be designed to cope with a specified
amount of movement, but beyond that there can be
severe reductions in performance with potentially serious
safety implications, e.g. liquid carry over into gas
streams to compressors (particularly reciprocating
compressors). Some mechanical equipment, e.g.
turbines & compressors, may also be adversely affected
(shaft axial alignment) by vessel flexing / motion.
The operating envelope, in terms of vessel movement,
for the process equipment on the installation should be
clearly specified and understood by the operational
crew.
Flare & relief system pipework should be constructed
such that liquids flow away from relief devices towards
the flare knockout drum. API RP 521 recommends a
slope of in. in 10 ft. (i.e. 1 in 480). Whilst this may be
satisfactory for land based process plant; it is often
inadequate for floating production units. Floating
installations, particularly semi-subs., may be
permanently trimmed to 0.5 to 1.0 (i.e. 1 in 115 to 1 in
57) to assist with deck run-off. If this trim opposes the
slope in the flare system, condensed liquids will
accumulate on the downstream side of relief devices,
limiting their capacity.
There should be clear instructions on action to be taken
when the limits of the operating envelope are reached,
and the parameters to be used to decide when this is the
case.
Indications are that some installations are continuing to
operate even in the most adverse of weather conditions
and resultant vessel movement. Inhibits / overrides
should not be applied to shutdown functions to
counteract the effects of vessel movement on the
process plant.

(It should be possible to determine when periods of

adverse weather have occurred and check, from
operator logs etc., whether there was compliance with
the required actions with respect to process operations).
DCR Reg. 7 requires limits within which the installation is to be operated have been recorded.
PUWER Reg. 4 requires work equipment to be suitable for the purpose for which it is used or
provided.
PUWER Reg. 8 requires instructions to include conditions and methods by which work
equipment may be used, foreseeable abnormal situations and the action to be taken...

- 59 -

Item
9.2

Inspection Topics
Guidance Notes
Turret Arrangements / Swivel Joints & Seals, Leakage & Recovery

9.2.1

Design limits
Are the operating limits for the
system clearly specified?
Are recuperation facilities
designed to withstand maximum
foreseeable pressure?

FPSOs have turret / swivel arrangements to allow

rotation of the vessel without damaging the risers /
moorings.
GASCET Section 5.1.HS18 gives information on the
mechanical integrity of FPSO turrets.
Some FPSOs have the drag chain type of turret / riser
arrangement with long flexible hoses connecting the
risers to the topsides plant. Drag chain turret
arrangements allow rotation of the vessel of up to 270,
and no rotational seals are required.
Other FPSOs have a swivel connected to the topsides
by shorter flexible hoses; each tier of the swivel can
move independently of the others. Some swivels have
rotation limiting devices to minimise the wear on the
seals and bearings. Where swivels are used, the
operating envelope, and allowable seal leakage rates,
should be clearly specified and understood.

9.2.2

Operations
Are there instructions on action to
take when the limits of vessel
rotation, or swivel seal leakage,
are reached?
Are swivel seals being regularly
flushed / greased to minimise
wear and reduce leakage?
Is there any evidence of leakage
of process fluids to atmosphere?

Legal
Basis

Recuperation facilities must be capable of withstanding

the maximum foreseeable fluid pressure, or be fitted with
relief devices to prevent overpressure, and be of
sufficient capacity to contain recovered fluids.
Whatever type of turret arrangement is used, the limits
for vessel rotation about the turret / swivel should be
understood and adhered to.
Special seal arrangements are fitted to the swivel to
prevent leakage to atmosphere or cross contamination
of fluids. The seals and their faces have to be kept clean
(i.e. free of sand or scale etc.); a seal flushing / greasing
facility is normally installed for this purpose.
Some leakage across the seals may occur. This should
be recovered in the recuperation system; leakage to
atmosphere may indicate damage to seals or an
inadequate recuperation system.

PUWER Reg. 4, work equipment has to be constructed or adapted as to be suitable for the
purpose for which it is used or provided.
PUWER Reg. 6, inspection.
PUWER Reg. 8, provision of information and instructions
SCR Reg. 12
PFEER Regs. 4, 5, 9 & 19
DCR Regs. 4-8

9.3

Integrity of Flexible Hoses

9.3.1

Inspection / Testing
Are inspection / testing
arrangements adequately in
place?

There should be a plan and records of the inspection /

testing of the flexible hoses, their connectors and
supports. For Coflexip type hoses, which are provided
with carcass leakage vents, there should be a system in
place for monitoring leakage.

- 60 -

Item

Inspection Topics

Guidance Notes

Legal
Basis

PUWER Reg. 6, inspection.

9.4

Inert Gas Controls / Cargo Tank Blanketing

9.4.1

Design

PUWER Reg. 8, provision of information and instructions.

Is the system adequately

protected against overpressure /
underpressure?

Cargo tanks on FPSOs are blanketed with inert gas to

prevent the ingress of air when cargo is being off-loaded
which may, when mixed with the hydrocarbon vapours in
the tanks, form flammable or explosive mixtures.
The inert gas generation system should be fitted with
shutdown and relief facilities, to prevent
overpressurisation of the cargo tanks.
During the transfer of crude oil from the cargo tanks, or
as the tank contents cool and contract, it is also possible
to pull a vacuum on the tanks if the inert gas system fails
to deliver the required quantity of gas. There should be
provision on the cargo tanks for vacuum relief

9.4.2

Operations
Are isolations controlled and
monitored using a locked open /
locked closed valve register?

Legal
Basis

The inert gas is normally produced by treating engine /

generator exhaust gas. The limits for oxygen
concentration in the inert gas and cargo tank vapour
space should be clearly specified, understood and
monitored by the operational crew.

There should be clear instructions to the operational

crew covering both the inert gas system and the isolation
/ de-isolation of cargo storage tanks. The presence of
closed isolation valves & spades in the cargo tank vent
lines to the vent headers has led to tanks being
overpressurised. Vent isolation valves should normally
be locked open, and recorded in a locked open / locked
closed valve register.
PUWER Reg. 4, work equipment has to be constructed or adapted as to be suitable for the
purpose for which it is used or provided.
PUWER Reg. 8, provision of information and instructions.

9.5

Marine & Process Systems Interfaces

9.5.1

Design
Are P&IDs adequate for process
requirements?
Are there any indications of
incompatibility between marine
and process systems?

9.5.2

Operations
Is there clear demarcation
between marine and process
systems?

Many FPSOs are converted oil tankers, and use is often

made of existing marine facilities for process operations.
Marine-based documentation, e.g. piping and instrument
diagrams, may not be to the standard normally expected
of the oil & gas industry.
Marine cooling system pipework may have been
designed to a different code from that of the process
topsides equipment. Where operators try to achieve
production targets with poorly designed or restricted
capacity plant, this may, in some cases, result in higher
than design crude oil rundown temperature to the cargo
tanks.
Procedures and instructions should clearly define where
there are marine / process interfaces, and highlight
potential problem areas. Where there are interfaces,
appropriate training should have been provided, so that
marine and process crews are both aware of the
consequences of their actions on the others systems.

- 61 -

Item

Inspection Topics

Guidance Notes

Legal
Basis

PUWER Reg. 4, work equipment has to be constructed or adapted as to be suitable for the
purpose for which it is used or provided.

9.6

HP Fuel Gas

9.6.1

Design

PUWER Reg. 8, provision of information and instructions.

Is the design of the fuel supply

system of adequate integrity?
Does the annular space, or
pressure protection, vent to a safe
location?

Some FPSOs have dual fuel diesel engines, which can

run on high-pressure fuel gas, compressed to a pressure
of around 350 barg. The fuel gas is routed to the engines
via double walled pipework. The outer pipe should be
designed to full system pressure, or adequately
protected against overpressure. The weak link in the
system is the flexible hose, or expansion joint from the
double walled pipework to the engine.
The double walled pipework should have its annular
space (or overpressure relief device) vented to a safe
location.
Continuous, or regular, monitoring of the double walled
pipework annular space should be undertaken to detect
leaks. The connections from the hard pipework to the
engines should be regularly inspected for signs of
deterioration.

9.6.2

Operations / maintenance

Legal
Basis

Are adequate arrangements in

place for monitoring of the annular
space, and inspection of
pipework?
PUWER Reg. 4, work equipment has to be constructed or adapted as to be suitable for the
purpose for which it is used or provided.
PUWER Reg. 6, inspection.

9.7

Gas Compression

9.7.1

Design
Have any design problems been
noted for use of compressors in a
marine environment?

Gas will normally be compressed using either centrifugal

or reciprocating compressors. Because FPSOs flex, due
to wave action, there have been problems with driver /
centrifugal compressor alignment on some installations.
The compressor package should have been designed to
maintain alignment as the vessel flexes but there may be
limits on vessel movement. Axial displacement
instrumentation for compressor shafts should have
appropriate alarm and trip settings.
Reciprocating compressors should have provision
(flexible mountings) to reduce transmission of vibration
to the vessel structure.

9.7.2

Legal
Basis

Operations

Procedures and instructions should clearly define the

operating and sea state envelopes for gas compressors.

Are operations crew aware of

operating / sea state limitations for
compressor operations?
PUWER Reg. 4, requires employers to ensure that work equipment is only used for
operations for which, and under conditions for which, it is suitable. Reg. 3(3) extends this duty
to others, including duty holders.
PUWER Reg. 8, requires instructions to include conditions and methods by which work
equipment may be used, foreseeable abnormal situations and the action to be taken,
conclusions to be drawn from experience of use, and for the information and instructions to be
readily comprehensible to those concerned.

- 62 -

Part 10 - Process plant construction & commissioning

This part reviews the way in which commissioning is managed; it is intended to examine the
roles of both onshore and offshore management. This may involve both onshore and offshore
inspection, depending on the scope of the work.
Item
10.1

Inspection Topics
Management System

10.1.1 Project Control

Is there a project safety plan?

Guidance Notes
All personnel, including third parties, should have been
made aware of the overall aims of the project and how
health and safety aspects are integrated into the plan.

Has the plan been adequately

communicated?
10.1.2 SMS Interfaces
Have SMS interfaces been
clarified?
10.1.3 Responsibilities
Have responsibilities been clearly
defined?

10.1.4 Change Control

Is there a procedure for controlling
changes arising from construction
and commissioning?
10.1.5 Risk Assessment
Is there a structured mechanism
for risk assessment?

Legal
Basis

If more than one SMS applies, measures should be in

place to ensure that there are no conflicts and that all
relevant information has been effectively communicated
to all parties.
Responsibilities should be clearly assigned. Where
projects involve the installation and commissioning of
vendor packages there can be a breakdown of
responsibilities if this is not adequately controlled. E.g.
where vendor packages are assembled and pressure
tested onshore then partially disassembled for shipment,
the parties involved may include vendor package,
project, hook-up contractor, and maintenance and
operations personnel.
Change control is an area where problems have been
found during OSDs inspection / audit of operating
companies / design houses.

Risk assessment procedures, relating to construction &

commissioning activities, should have been made
available to all relevant parties. Previous HSE inspection
/ audit experience has shown that risk assessments
have often not adequately reflected the potential
consequences.

Does risk assessment adequately

reflect potential consequences?
MHSWR Reg. 3, requirement for suitable and sufficient risk assessment.
MHSWR Reg. 4, requirement to apply principles of prevention.

MHSWR Reg. 5, requires a record of arrangements for planning, organisation, control,

monitoring and review of preventive and protective measures.
MHSWR Reg. 10, requires provision of comprehensible and relevant information.
MHSWR Reg. 11, requires cooperation and coordination between employers.

10.2

Post Design

10.2.1 HAZOP
Have HAZOP and / or other safety
studies (e.g. API RP 14C review of
HP / LP interfaces) been carried
out at the design stage?

HAZOP studies should be formally recorded with lists of

resulting actions (where necessary). Carrying out
specific HP / LP interface studies in addition to HAZOP,
such as an API RP 14C review, is accepted good
practice.

- 63 -

Item

Inspection Topics

Guidance Notes

Has an action list been produced

and an action tracking system set
up?

There should be a system in place to follow up and close

out HAZOP actions.

Have all actions been closed out

(i.e. completed & signed off)?
10.2.2 Changes / Modifications
Have new HP / LP interfaces,
created as a result of changes,
been reviewed and actioned as
above?
10.2.3 Operating Procedures
Have relevant operating
procedures (new & revised),
resulting from the project, been
prepared?
10.2.4 Training
Are adequate arrangements in
place for the training of operators &
technicians?
Legal
Basis

Actions should be closed out in a timely manner (i.e.

relative to the priorities assigned to them).
For additions to existing process plant, it is important
that all factors affecting the existing plant have been
addressed.

Procedures should have been developed, reviewed,

approved and formally issued in advance of
commissioning. Where there have been additions, or
modifications, to existing process plant, procedures
should be updated to reflect the changes.
Operator / technician training can commence when the
design has been fixed (i.e. approved for construction)
and operating procedures become available.

MHSWR Reg. 3, requirement for suitable and sufficient risk assessment.

PUWER Reg. 4, work equipment has to be constructed or adapted as to be suitable for the
purpose for which it is used or provided.
PUWER Reg. 8, provision of information and instructions.
PUWER Reg. 9, provision of adequate training.

10.3

Pre-construction

10.3.1 Hazard analysis

Has a study of all potential
hazards, arising out of the
construction phase, been carried
out (e.g. analysis of activities such
as lifting adjacent to or over, live
process plant)?
10.3.2 Procedures
Are procedures available detailing
methods of work and precautions
to be taken?

Legal
Basis

Procedures should have been developed to cover these

activities.
An action tracking system should have been set up, and
actions should be closed out (i.e. completed & signed
off).

Procedures should have been developed covering

precautions required for construction activities such as
equipment lifts adjacent to, or over, live process plant
etc.

If more than one SMS applies, effective measures

Is there compatibility of procedures should be in place to ensure that there are no conflicts
and that relevant information has be effectively
for the control of construction
communicated to all parties.
work?
MHSWR Reg. 3, Requirement for suitable and sufficient risk assessment.
PUWER Reg. 8, Provision of information and instructions.
LOLER Reg. 8, Organisation of lifting operations.

- 64 -

Item
10.4

Inspection Topics
Construction

10.4.1 Piping, Flange Joints, & Small

Bore Pipework / Tubing
Is there a system of competence
assurance for piping / tubing work?
Is there a system in place for
identifying critical flange joints, and
recording torque / tension settings?

Guidance Notes
Problems have been experienced with incorrectly
assembled piping flange joints and small bore fittings.
The problems include the use of incorrect or
incompatible materials and fittings, incorrectly tensioned
bolts in flanged joints, over or under tightened
compression fittings and insufficient tubing / piping
length inserted into compression fittings.
To reduce the probability of leaking joints, there should
be systems in place for competence assurance of the
personnel carrying out and inspecting such work. The
system(s) may include the retraining / testing of
personnel.
Joints identified as safety critical should require bolts to
be torqued or tensioned to specified values and the work
to be witnessed by independent parties. These values
should be formally recorded and tagged as per the
latest industry guidelines.

Note: For management of small bore pipework and

bolted flange joints, please see part 2 and part 7
respectively.
Modifications such as re-routing pipework around
10.4.2 Control of change
obstructions, or tie-ins into existing plant at different
locations from the design, or altering the
Is there a system in place to
elevation/location of a PSV (which could affect draining
assess safety implications of
of the discharge line into the flare header) would be
modifications carried out during
typical of those, which may bypass procedures.
construction?
Legal PUWER Reg. 4, work equipment has to be constructed or adapted as to be suitable for the
Basis purpose for which it is used or provided.
PUWER Reg. 8, provision of information and instructions.
PUWER Reg. 9, provision of adequate training.

10.5

Commissioning

10.5.1 Procedures
Have procedures been developed
and approved?
Is there a system for controlling
distribution, changes and status?

Commissioning activities include cleaning / flushing,

drying, pressure / leak testing, and function testing.
Commissioning procedures should have been produced
and made available to all relevant parties. The project
document control system should cover the distribution
and checking of project documentation across all parties

Have all parties, including

contractors personnel, received
relevant documentation?

- 65 -

Item

Inspection Topics

10.5.2 Cleaning / Flushing / Drying

Have process pipework and
vessels been cleaned / flushed to
remove debris (scale, slag etc.)?

10.5.3 Pressure Testing / Leak Testing

Are adequate arrangements in
place for pressure / leak testing?

Guidance Notes
The flushing process would normally be carried out
using a high volume flow of compatible fluid, i.e.
normally fresh water but special fluid or hydraulic oil for a
hydraulic system so as not to contaminate the system
with water. For some systems seawater may be used for
flushing but it should be inhibited as required. Some
systems, e.g. stainless steel, may require fresh water
flush, following seawater, to remove chlorides.
Following water flushing, the system is drained at low
points; residual water may be blown out of the system
using dry air. Where the system is to be left empty for
more than a few days, it should be blanketed with dry air
or nitrogen to prevent internal corrosion. For prolonged
periods in this state, the system may need to be treated
with corrosion inhibitor.
Pressure testing includes proof / strength testing, and
leak testing. Pressure testing can be carried out either
hydraulically or pneumatically. Wherever practicable
hydraulic testing should be employed to reduce the risks
to personnel. Guidance is available in Safety in
Pressure Testing, HSE Guidance Note GS4 (3rd ed.
1998).
Strength testing is carried out to prove the quality of
materials and the construction of the equipment / system
before it enters service. Test pressure is typically 1.25 1.5 x system design pressure. All temporary connections
must be adequately rated for the test. Relevant
standards are:

10.5.4 Function Testing

Has function testing been carried
out, and signed off?

10.5.5 Documentation / Records

EN 13445 (replacing BS 5500) - 1.25 x design

ASME VIII Div.1 - 1.5 x design
ANSI B31.3 (topsides pipework) - 1.5 x design

Pneumatic leak testing is normally carried out at

relatively low pressure (not exceeding 10% design
pressure; normally ~2 barg) to identify leaks prior to
hydrostatic testing or reinstatement testing at higher
pressures. Testing with soap (or proprietary) solution, or
inert gas with tracer (usually helium) is commonly carried
out.
Function testing is carried out using a suitable test
medium at design pressure, or working pressure if this is
lower, to check the function of components including the
actuation of moveable parts. (Inspection on one
installation showed that not all shutdown trips were
function tested because the project was behind
schedule).
Each of the commissioning activities should have
documented records.

Is there a system for recording

activities, test results, rectification
work, re-testing etc.?

- 66 -

Item

Inspection Topics

Guidance Notes

For vendor packages, it is beneficial for operators and

technicians to gain familiarity with the equipment by
becoming actively involved in the commissioning,
Does the training programme
working alongside the vendors personnel. Evidence
include involvement in the
from audits indicates that whilst installation personnel
commissioning of vendor
were meant to become involved in the commissioning of
packages?
vendor packages they were sometimes seen as slowing
down progress and were discouraged from detailed
involvement. Packages were handed over to installation
personnel who had only limited knowledge of how to
maintain and operate them.
PUWER Reg. 8, provision of information and instructions.

10.5.6 Training

Legal
Basis

PUWER Reg. 6, requirement to inspect work equipment after it has been installed and put into
service for the first time, or after assembly at a new site or location. Requirement to keep
records of inspection.
PUWER Reg. 12, protection against specific hazards. Cleaning, flushing and pressure testing
contribute to the overall scheme of taking measures to prevent the unintended discharge of
fluids from the work equipment.

10.6

Post Commissioning

10.6.1 Punch Lists

Legal
Basis

Punch lists are normally used to collate problems that

come to light during commissioning, and to prioritize
Is there an adequate system in
actions. Typical items, which may not be progressed in a
place to identify punch list items,
timely manner, are valve tagging, repairs to damaged or
and track them to completion?
missing insulation, plugging or blanking off open ends of
small bore pipework.
PUWER Reg. 4, work equipment has to be constructed or adapted as to be suitable for the
purpose for which it is used or provided.
PUWER Reg. 8, provision of information and instructions.

- 67 -

Part 10 Glossary
ACOP
DCR
DH
ESD
ESDV
FMEA
FPOSO
HAZID
HAZOP
HCR
HIPS
HSWA
ICP
LOPA
MAH
MHSWR
NUI
ORA
OSD
PFEER
PTW
PUWER
QRA
SBT
SC
SCE
SCR
SIL
SMS
SSIV

Approved Code of Practice

Offshore Installations and Wells (Design and Construction, etc)
Regulations 1996
Duty holder
Emergency shutdown
Emergency Shutdown Valve
Failure modes and Effects Analysis
Floating Production, Storage and Offloading Vessel
Hazard Identification Study
Hazard and Operability Study
Hydrocarbon Release
High Integrity Protection System
Health and Safety at Work etc. Act 1974
Independent Competent Person
Level of Protection Analysis
Major Accident Hazard
Management of Health and Safety at Work Regulations 1999
Normally Unattended Installation
Operational risk assessment
Offshore Division
Offshore Installations (Prevention of Fire and Explosion, and Emergency
Response) Regulations 1995
Permit to work
Provision and Use of Work Equipment Regulations 1998
Quantified risk assessment
Small bore tubing
Safety Case
Safety critical element
Offshore Installations (Safety Case) Regulations 2005
Safety integrity level
Safety management system
Sub Sea Isolation Valve

- 68 -