Design and Engineering Manual DEM 2 – Process Safety

Basic Requirements

Shell HSSE & SP Control Framework Mandatory

Process Safety Manual Restricted
Version 5, December 2009
See Change Log for details on version control

Purpose
To prevent re-occurrence of known major Process Safety Incidents by focussing on their
main causes and key Barriers.

Who is this for?

 Asset Managers and Project Managers

What situations are/are not covered?

This manual section applies to:
Assets that have process Hazards with RAM red Risks and yellow 5B Risks and that are used
for exploring, drilling, producing, processing, transporting or storing Hazardous Substances
or energy, including:
 Shell Assets and Assets owned or operated by a Joint Venture in which Shell has a
Controlling Interest, including:
o wells
o pipelines, including midstream and local gas distribution
o Upstream production facilities including associated floating and fixed
structures
o refineries and chemical plants
o gas liquefaction plants and re-gasification installations
o coal gasification and gas/coal to liquid plants
o product storage and handling facilities for:
 road transport, and
 rail and ship loading and discharge;

 Assets owned or operated by a Joint Venture in which Shell does not have a
Controlling Interest,
if the Joint Venture partners adopt this Manual following promotion by the Shell
Shareholder Representative as stated in JV HSSE Requirements;
 contracted 3rd party Assets, including temporary boilers, liquid nitrogen storage, and
power generators; and
 land transport activities by vehicles used to transport Hazardous Substances.

This manual section does not apply to:

 small bulk consumer facilities, LPG customers’ installations and LPG cylinders;
 ships and other maritime vessels for which design and engineering requirements are
covered by a STASCO (Shell International Trading and Shipping Company Limited)
accepted “Classification Society”;
 aircraft and aviation activities; including activities related to the refuelling of the
aircraft;
 occupied buildings outside Classified Areas; and
 Abandonment Activities.

1
Defined terms can be found in the HSSE & SP Control Framework Glossary.
This document is not controlled when printed. See the Change Log for version control information.
Shell HSSE & SP Control Framework Mandatory
Process Safety Manual Restricted
Version 5, December 2009

Requirements
The Asset Manager is Accountable for requirement 1 below:
1. Meet the Process Safety Basic Requirements that are specified in Table 1.
1.1 Derogation of the application of Process Safety Basic Requirements
requires approval by the Royal Dutch Shell Chief Executive Officer.
1.2 Derogation of the application of Process Safety Basic Requirements for
Assets owned or operated by a Joint Venture in which Shell does not have a
controlling interest, and where the Joint Venture partners have adopted this
manual, requires approval by those Joint Venture partners.

Table 1 Process Safety Basic Requirements

PSBR 1 Safe siting of occupied portable buildings

PSBR 2 ESD valves on platform risers

PSBR 3 Temporary refuges

PSBR 4 Permit To Work

PSBR 5 Management Of Change

PSBR 6 Avoid liquid release relief to atmosphere

PSBR 7 Avoid tank overfill followed by vapour cloud release

PSBR 8 Avoid brittle fracture of metallic materials

PSBR 9 Alarm management

PSBR 10 Sour Gas (H2S)

2
Defined terms can be found in the HSSE & SP Control Framework Glossary.
This document is not controlled when printed. See the Change Log for version control information.
Shell HSSE & SP Control Framework Mandatory
Process Safety Manual Restricted
Version 5, December 2009

Explanation to Table 1

PSBR 1 Safe siting of occupied portable buildings

Purpose

To manage the Risk of harm to people that are occupying portable buildings.

What situations are covered?

Onshore Assets that have process Hazards with RAM red Risks and yellow 5B Risks.

Requirements

1. Portable blast-resistant modules shall be rated for a peak side-on over-pressure of at

least 55 kPa with a duration of at least 100 ms.

2. Their location shall be assessed and approved in accordance with DEP 34.17.10.33-Gen.
“Portable blast resistant modules”.

3. Their design shall be in accordance with DEP 34.17.10.33-Gen. “Portable blast resistant
modules”.

4. All other portable buildings shall be located in accordance with draft DEP 34.17.10.35-
Gen. (under development and based on DSM 2500005-1 August 2005 Siting of Occupied
Portable Buildings and will be written in the form of amendments and supplements to the
new API RP 753:2007 Management of Hazards Associated with Location of Process Plant
Portable Buildings).

Major incidents in industry

BP Texas City Isomerisation Unit Explosion, Texas, USA, March 23, 2005

3
Defined terms can be found in the HSSE & SP Control Framework Glossary.
This document is not controlled when printed. See the Change Log for version control information.
Shell HSSE & SP Control Framework Mandatory
Process Safety Manual Restricted
Version 5, December 2009

PSBR 2 ESD valves on platform risers

Purpose

To manage the Risk of harm to people occupying offshore installations.

What situations are covered?

Offshore pipelines or production installations that have process Hazards with RAM red Risks
and yellow 5B Risks.

Requirements

1. For offshore pipelines containing flammable or toxic fluids an ESD valve shall be located
at the top of each riser connected to a manned offshore installation. The ESD valve shall
be located in a position:

o in which it can be safely inspected, maintained and tested;

o such that it is above water;

o such that its exposure to topside incidents is minimised; and

o subject to the above, such that the distance from the ESD valve to the base of the
riser is as short as reasonably practicable.

2. For pipelines containing flammable or toxic fluids and connected to a manned offshore
installation, an additional subsea isolation valve (SSIV) located on the seabed close to the
installation shall be installed if required by the installation’s HSSE Case. The distance of the
SSIV from the installation should be such that the combined Risk associated with the
installation activities and the pipeline fluid inventory between the SSIV and the installation is
ALARP.

3. Flammable and toxic fluids are Category B, D, and E fluids as defined in ISO 13623:2000
Petroleum and natural gas industries – Pipeline transportation systems.

Major incidents in industry

Piper Alpha Platform, UK, North Sea, July 6, 1988

4
Defined terms can be found in the HSSE & SP Control Framework Glossary.
This document is not controlled when printed. See the Change Log for version control information.
Shell HSSE & SP Control Framework Mandatory
Process Safety Manual Restricted
Version 5, December 2009

PSBR 3 Temporary refuges

Purpose

To manage the Risk of harm to people occupying offshore installations.

What situations are covered?

Offshore installations that have process Hazards with RAM red Risks and yellow 5B Risks.

Requirements

1. Every offshore installation has a temporary refuge (TR).

2. The main function of the TR is to provide a place where the total personnel on board
(POB) can muster without undue Risk and still have access to the communications,
monitoring and control equipment necessary to ensure their personal safety, and from
where, if necessary, safe and complete evacuation can be effected.

3. The escape and evacuation routes and the embarkation areas provide:

o secure means of escape to the TR; and

o secure means for a complete evacuation from the TR.

4. Means of satisfying these requirements are specified in DEP 37.17.10.11-Gen.

“Design of offshore temporary refuges”.

Major incidents in industry

Piper Alpha Platform, UK, North Sea, July 6, 1988

5
Defined terms can be found in the HSSE & SP Control Framework Glossary.
This document is not controlled when printed. See the Change Log for version control information.
Shell HSSE & SP Control Framework Mandatory
Process Safety Manual Restricted
Version 5, December 2009

PSBR 4 Permit To Work

Purpose

To control hazardous work and work that could interfere with other hazardous operations,
using a written procedure that establishes and communicates the controls necessary for safe
working.

What situations are covered?

Hazardous work that does not have established control measures; and

Work that could adversely affect the control of HSSE Risk in other hazardous operations
occurring at the same time or that could itself be adversely affected by those operations.

Requirements

1. Meet the requirements for the Permit To Work systems specified in Permit to Work.

2. Verify the effectiveness of the Permit To Work system of the Asset using a tiered
approach ranging from daily monitoring to less frequent self-assessments.

3. Make the effectiveness of the Permit To Work system and the Permit To Work verification
process part of each Independent HSSE MS audit.

Major incidents in industry

Piper Alpha Platform, UK, North Sea, July 6, 1988

Motiva Enterprises LLC, Delware, USA, July 17, 2001

Shell Port Edouard Herriot Depot, Lyon, France, June 2, 1987

BP Grangemouth Flare Line Fire, Scotland, UK, March 13, 1987

6
Defined terms can be found in the HSSE & SP Control Framework Glossary.
This document is not controlled when printed. See the Change Log for version control information.
Shell HSSE & SP Control Framework Mandatory
Process Safety Manual Restricted
Version 5, December 2009

PSBR 5 Management Of Change

Purpose

To avoid incidents resulting from unforeseen consequences of Process Changes, Procedural

Changes or Organisational Changes.

What situations are / are not covered?

Applies to:

 Process Changes (Hardware, Process Control and Process Condition Changes);

 Procedural Changes;

 Organisational Changes.

Does not apply to:

 Procedural changes that do not affect HSSE critical content;

 Changes managed by other established Group change management processes that

include HSSE Risk management, such as Major Capital Projects, IT releases, skillpool and
succession planning;

 Business continuity planning, and acquisitions and divestments;

 Like For Like Replacement (equipment or personnel);

 Organisational changes that do not involve transfer of HSSE Critical Activities.

Requirements

1. The requirements are specified in Management of Change.

2. Verify the effectiveness of the Management Of Change system of the Asset using a tiered
approach ranging from daily monitoring to less frequent self-assessments.

3. Make the effectiveness of the Management Of Change system and the Management Of
change verification process part of each independent HSSE MS audit.

Major incidents in industry

Dutch State Mines Nypro Plant, Flixborough, UK, June 1, 1974

Chernobyl, USSR, April 26, 1986

7
Defined terms can be found in the HSSE & SP Control Framework Glossary.
This document is not controlled when printed. See the Change Log for version control information.
Shell HSSE & SP Control Framework Mandatory
Process Safety Manual Restricted
Version 5, December 2009

PSBR 6 Avoid liquid release relief to atmosphere

Purpose

To manage the Risk of harm to people due to release and ignition of flammable
hydrocarbons.

What situations are covered?

Assets that have process Hazards with RAM red Risks and yellow 5B Risks and that are used
for producing, processing, transporting or storing hydrocarbon liquid above its flash point.

Requirements

1. Create for each Asset an inventory of all atmospheric vents that have the potential to
release hydrocarbon liquid above its flash point.

2. Assess the Risk of each of these vents and define the Risk mitigation in accordance with
Managing Risk.

3. Document and implement the resulting remedial steps.

Major incidents in industry

BP Texas City Isomerisation Unit Explosion, Texas, USA, March 23, 2005

8
Defined terms can be found in the HSSE & SP Control Framework Glossary.
This document is not controlled when printed. See the Change Log for version control information.
Shell HSSE & SP Control Framework Mandatory
Process Safety Manual Restricted
Version 5, December 2009

PSBR 7 Avoid tank overfill followed by vapour cloud release

Purpose

To manage the Risk of harm to people due to release and ignition of flammable
hydrocarbons.

What situations are covered?

Assets that have process Hazards with RAM red Risks and yellow 5B Risks and that are used
for producing, processing, transporting or storing fluids that have the potential to form a
vapour cloud.

Requirements

1. Create for each Asset an inventory of all storage tanks containing fluids that have the
potential to overfill resulting in a vapour cloud explosion. Examples of such fluids are
finished gasoline, gasoline components, naphtha(s), benzene, methyl ethyl ketone,
MTBE, acetone, pentane, special boiling point solvents SBP1 and SBP2, and natural gas
liquids (condensates) and crude oils with a Reid Vapour Pressure RVP > 2.5 psi.

2. Assess the Risk of each tank and define the Risk mitigation in accordance with Managing
Risk.

3. Document and implement the resulting remedial steps.

Major incidents in industry

Buncefield storage terminal explosion, UK, December 11, 2005

9
Defined terms can be found in the HSSE & SP Control Framework Glossary.
This document is not controlled when printed. See the Change Log for version control information.
Shell HSSE & SP Control Framework Mandatory
Process Safety Manual Restricted
Version 5, December 2009

PSBR 8 Avoid brittle fracture of metallic materials

Purpose

To manage the Risk of harm to people due to release and ignition of flammable
hydrocarbons.

What situations are covered?

Assets that have process Hazards with RAM red Risks and yellow 5B Risks and that are used
for producing, processing, transporting or storing liquefied gas (LPG, LNG) or compressed
flammable low molecular weight hydrocarbon gas.

Requirements

1. For each Asset, determine the lower design temperature (LDT) or alternatively the
minimum allowable temperature (MAT) for all unfired pressure vessels, heat exchangers,
piping, piping components and valves (including control valves) or rotating equipment,
containing liquefied gas or compressed flammable low molecular weight hydrocarbon
gas.

2. Take measures to prevent the equipment being at pressure below the LDT or
alternatively ensure the equipment metal temperature is not below the appropriate MAT
at any given operating pressure. Consider scenarios in which equipment temperature can
drop such as blow-downs, as well as scenarios of subsequent (re-)pressurization of
equipment.

3. The definitions of LDT and MAT as well as appropriate brittle fracture assessment
methods are described in DEP 30.10.02.31-Gen “Metallic materials - prevention of brittle
fracture”

Learning from incidents

Esso Longford Gas Plant Explosion, Australia, September 25, 1998

10
Defined terms can be found in the HSSE & SP Control Framework Glossary.
This document is not controlled when printed. See the Change Log for version control information.
Shell HSSE & SP Control Framework Mandatory
Process Safety Manual Restricted
Version 5, December 2009

PSBR 9 Alarm management

Purpose

To manage the Risk of harm to people and the environment due to lack of control in
abnormal operational situations.

What situations are covered?

Assets that have process Hazards with RAM red Risks and yellow 5B Ri sks and that are used
for exploring, drilling, producing, processing, transporting or storing Hazardous Substances
or energy.

Requirements

1. Each Asset shall have an alarm management system that provides the operator with an
adequate set of warnings against excursions beyond its safe operating limits both during
normal operation and during abnormal situations (startups, shutdowns and upsets),
whilst minimizing and where necessary suppressing, standing alarms, nuisance alarms,
repeating alarms and alarm floods.

2. One way of meeting these objectives is to follow DEP 32.80.10.14-Gen “Alarm

management“.

Major incidents in industry

Three Mile Island Nuclear Reactor Core Meltdown, Pennsylvania, March 28, 1979

Esso Longford Gas Plant Explosion, Australia, September 25, 1998

11
Defined terms can be found in the HSSE & SP Control Framework Glossary.
This document is not controlled when printed. See the Change Log for version control information.
Shell HSSE & SP Control Framework Mandatory
Process Safety Manual Restricted
Version 5, December 2009

PSBR 10 Sour Gas (H2S)

Purpose

To manage the Risk of harm to people and the environment by exposure to Sour Gas.

What situations are covered?

 Facilities and activities where Sour Gas may be present.

Requirements

1. Meet the requirements specified in Acute Toxic Substances.

2. Assess the safety Risks for Sour Gas operations, including non-routine
operations, Concurrent Operations and Confined Space entry.

3. Meet the requirements as specified in Emergency Response.

4. Base Emergency incident scenarios on Sour Gas dispersion modelling and take into
account local regulations.

5. Include identification of evacuation sites and evacuation activities in the testing of the
Emergency Response Plans and Procedures.

Major incidents in industry

Chuandongbei gas well blow-out, Gao Qiao, China, December 23, 2003

12
Defined terms can be found in the HSSE & SP Control Framework Glossary.
This document is not controlled when printed. See the Change Log for version control information.
Shell HSSE & SP Control Framework Mandatory
Process Safety Manual Restricted
Version 5, December 2009

Implementation Deadlines

Background
While process safety incidents are rare, we know about their potential to cause injury and
even death, as well as damage to the environment, our business and our reputation.
Avoiding a major process safety-related incident within our asset base is a priority and
requires a Group-wide approach.
The Group Asset Integrity-Process Safety Management Standards (AI-PSM) are part of the
new HSSE Control Framework and are applicable across all Businesses for ventures under
operational control. The HSSE Control Framework will give line management practical tools
to help with risk identification, drive the implementation of associated controls and provide
the means to assess the effectiveness of these controls.

Process Safety Basic Requirements

The AI-PSM Standards (effective 1 October 2008) require the establishment a single set of
mandatory Shell Design And Engineering Manuals. DEM2 is a supporting document for the
AI-PSM Standards and will include a set of Process Safety Basic Requirements (PSBRs) that
are common across the Group. They will be developed by 31 December 2008, and may be
updated over time.

The initial set of requirements will be created in consultation with the Businesses and the
HSSE function using learning from significant process safety incidents such as BP Texas City,
Longford and Piper Alpha. The PSBRs will include important elements of design and
construction and/or operation. In addition to their full application in the design of new
facilities, they will be required at all existing facilities within the shortest practical
timeframe.

The initial set of PSBRs will include a timeline for conducting gap analyses and developing
gap closure plans to address any discrepancies. This timeline will be defined by the
Businesses. The final date for developing gap closure plans for the initial set of requirements
is 31 December 2010.

After gap analyses are complete, the Business head must agree a suitable work plan and
timeline with the Royal Dutch Shell Chief Executive for implementing the PSBRs in that
Business.

If you have any queries regarding the Design and Engineering Standards, Process Safety
Basic Requirements or the HSSE Control Framework, please contact:

Neil Reeve, GSNL-GSEMH, Shell Standards Manager

Arjan van Dijk, SI-CAE, Group Safety Manager

13
Defined terms can be found in the HSSE & SP Control Framework Glossary.
This document is not controlled when printed. See the Change Log for version control information.