Copyright 1999, Society of Petroleum Engineers, Inc.

This paper was prepared for presentation at the 1999 SPE Offshore Europe Conferenceheld in Aberdeen, UK, 7-10 September 1999.

This paper was selected for presentation by an SPE Program Committee following reviewof information contained in an abstract submitted by the author(s). Contents of the paper,as presented, have not been reviewed by the Society of Petroleum Engineers and aresubject to correction by the author(s). The material, as presented, does not necessarilyreflect any position of the Society of Petroleum Engineers, its officers, or members. Paperspresented at SPE meetings are subject to publication review by Editorial Committees of theSociety of Petroleum Engineers. Permission to copy is restricted to an abstract of not morethan 300 words. Illustrations may not be copied. The abstract should contain conspicuousacknowledgement of where and by whom the paper was presented. Write Librarian, SPE,

PO Box 833836, Richardson, TX 75083-3836, USA, Fax: 01-214-952-9435.

AbstractLoss of hydrocarbon containment accidents present thegreatest threat to the offshore workforce. Hence it isimperative that the highest standards are maintained withrespect to the design and operation of offshore process plant.The Offshore Safety Division (OSD) of the UK Health andSafety Executive, the British health and safety regulatorybody, has undertaken a series of theme audits examining themanagement of offshore hydrocarbon production facilities.The focus for the audits was the adequacy of the safetymanagement systems in place to control hydrocarboncontainment and included both design and operationalaspects. The paper discusses the principal findings from theaudits and describes actions required to further improveprocess plant integrity management over the lifecycle of anoffshore installation.

IntroductionThis paper describes the main general problem areas withrespect to offshore process integrity management identifiedduring 8 audits of installations on the UK Continental Shelfover the period 1996 to 1998. The audits which were carriedout by the Offshore Safety Division of the UK Health andSafety Executive, encompassed a range of operatingcompanies and also covered different installation types fromlarge oil installations through to floating production facilitiesand manned gas platforms. The audits examined the management of process operationsby each dutyholder. This involved looking in detail at aprocess related 'slice' of each dutyholder's safetymanagement system against the concepts expressed in

HS(G)65, HSE's guidance document on Successful Healthand Safety Management. This included issues such as:(a) was the plant being operated and maintained in a safemanner through the development and enforcement of safeworking practices; (b) was the plant design as safe asreasonably practicable and had all potential problem areasbeen identified by the dutyholder and were they beingmanaged effectively. The key findings from the audit reports are distilled intothis paper. Whilst only the significant problem areasidentified are detailed, this should not obscure the fact thatthere were many positive features found during the auditsand that many aspects of the process operations had beencompetently designed and were well managed.

Operational Problem AreasProcedural ControlsControl of locked valves. Many installations have a numberof safety critical valves which are meant to be either lockedopen or locked closed, for example around dual pressurerelief valve arrangements. In some cases a proprietarylocking system will be used but often a chain and padlocksystem will be employed. In all cases there should be a valveregister identifying the valves affected, where they arelocated, the position in which they are to be locked and thefrequency with which their status is to be checked. Thereshould also be status check sheets indicating when checkswere last carried out, by whom and the results obtained. The audits indicated that without very close supervisorymonitoring, problems can easily occur with locked valvesystems. On the majority of installations inspected, exampleswere found of valves that were either not locked or werelocked in the wrong position. On one installation it was clearthat the declared system had not operated for a considerableperiod of time in that the relevant valve register could not befound nor could records of any valve status checks.

Control of inhibits and overridesTypical process plant will contain a number of protectivetrips to prevent equipment usage outside its safe operatingenvelope. There will be inhibits or overrides for these

SPE 56986

Managing Offshore Process Plant IntegrityJ.N.Edmondson & K.Findlay, Offshore Safety Division of the UK Health and Safety Executive

devices, for start-up and maintenance purposes, which mayoccasionally be used for the short-term maintenance ofproduction whilst a faulty instrument is repaired. In all cases,a detailed register should be kept of all 'live' inhibits andoverrides together with the reason for their activation andhow long they have been in operation. Details should also bekept of related risk assessments. The register entries and therisk assessments should also be regularly and formallyreviewed and approved by a nominated responsible personsuch as the production superintendent. The review shouldalso include an appraisal of the possible cumulative effectsof the various overrides that are in place. Particular problems encountered were: (a) inhibits andoverrides initially activated to overcome short-termproduction problems had become long-term without properassessment as to whether this was acceptable; or, whethertheir continuing existence was eroding declared safetymargins. For example, to avoid potential gas 'blowby'problems between systems operating at different pressures,any interconnecting vessels such as gas/liquid separators willusually have a low low level trip as a safety barrier on theliquid outlet stream from the higher pressure vessel. In anumber of cases because of reliability problems with thelevel measuring device, the trip function had beenpermanently overriden in breach of good practice anddutyholders stated design standard (API RP 14C); (b)breakdown of discrete elements of the recording, monitoringand review process. On one installation, overrides put onduring the shift were being removed prior to shift hand-overso that there was nothing to report. Supervisory monitoringwas not identifying the existence of the overrides; (c) noconsideration or risk assessment of possible interactionsbetween a number of different inhibits and overrides. Whilstrisk assessments for individual overrides were frequently inplace, risk assessments of possible cumulative andsynergistic effects were frequently overlooked.

FPSO process operations in adverse weatherThe performance of process equipment (eg separators,dehydration and gas treatment contactor columns) on FPSOscan be significantly affected by wave-induced vesselmovement. The equipment will normally be designed to copewith a specified amount of movement but beyond that therecan be severe reductions in performance with potentiallyserious safety implications, eg liquid carry-over into gasstreams to compressors. It is important however that: (a) theoperating envelope in terms of vessel movement for theprocess equipment on each FPSO has been clearly specifiedand is understood by the operational crew; (b) there are clearinstructions to the operational crew, as to what action shouldbe taken when the limits of the operating envelope arereached and the parameters to be used to decide when this isthe case; c) the appropriate action defined in the instructionsis actually carried out. Situations were identified where thesecriteria were not being met.

Identification of process equipment, valves andinstruments

Process equipment, valves and instruments on an installationshould be clearly tagged or marked to facilitate their rapididentification. Several incidents have occurred in the pastwhere the wrong item has been operated or maintained. Theaudits have revealed installations where not all relevant itemshave been marked. Accurate plant identification is of greatimportance. This is particularly the case on newer, moreautomated plant where there will be fewer plant operatorsand less physical intervention. As a result individuals maynot be as familiar with the location of all equipment.Accurate identification of lines, valves, equipment etc isimportant in promoting safe isolations and interventions.

Inadequate/out-of-date operating instructionsTypical problems identified were: (a) operating instructionswhich had not been modified to reflect plantmodifications/upgrades or changed operating procedures; (b)operating instructions which did not cover all possibleoperating modes, eg different operating configurations wereoccasionally employed, some of which had no writtenprocedures; (c) operating instructions which had no officialstatus. Frequently these would appear as 'ad-hoc' instructionsproduced by production operators themselves outwith themanagement system and without formal managementapproval (sometimes without management's knowledge) ; (d)instances where different versions of the same procedureswere in existence.

Inadequate vetting/monitoring of workplace riskassessmentsCurrent offshore practice places much emphasis on localworkplace risk assessment in the overall control of risklevels. However there are indications that such assessmentscan become routinely mechanistic and superficial unlesstheir quality and rigour is regularly monitored andchallenged by management. Evidence from the auditssuggested that this was not always occurring. For example,an assessment of the effects of removing a high high pressuretrip on the discharge of an oil export pump indicated theconsequences to be 'none' even though there was thepotential for export riser and/or pipeline rupture. Assessmentalso needs to be undertaken by staff with an appropriate levelof technical competence. For example, offshore staff maynot always be sufficiently knowledgeable to make decisionson proposed changes that are technically very complex. It isimportant that this is recognised and that there are robustguidelines as to when issues should be referred back toonshore staff. The monitoring process should also extend tochecking that onshore staff are delivering an appropriatelevel of support.

Inadequate performance monitoringWhilst dutyholders usually had in place procedures to covera wide range of different tasks and activities (eg ESDVtesting, F&G alarm testing etc), in a number of cases therewas inadequate first line supervisor/management monitoringthat these procedures were actually being followed. Notargets for monitoring were being set, ie what should be

monitored, how often, sample size etc. As a result, clearshortfalls in performance had not been identified. Forexample, on one installation detailed procedures had beendeveloped for the frequency and nature of ESDV testing. Inpractice these procedures were not being followed andtesting was only being carried out on a very infrequent basis,yet the installation management was unaware of this due to alack of active performance monitoring. On some installationsthere appeared to be misunderstandings as to the relativeroles of monitoring and audit, with the supervisors confusingtheir monitoring role with that of external auditors,

TestingSetting and verification of performance standards. Onoffshore installations, there are a number of areas wheresafety critical items of equipment, (eg ESDVs, SSIVs etc)need to be tested regularly against predeterminedperformance standards. Particular problems identified in theaudits were: a) performance standards for the closure timesof ESDVs and SSIVs not being set; b) closure time tests notbeing carried out or not being carried out with the declaredregularity; c) shutdown valve leak rate performancestandards not being set, tests not being carried out or notbeing carried out with the declared regularity; d) tests(closure time, leakage rate etc) being carried out but thoseresponsible being unaware of what action should be taken ifthe standard was not met; e) incomplete testing of valveclosure systems. Some ESDVs have dual circuit closuremechanisms, where operation of either circuit will close thevalve. Testing had sometimes been confined merely tochecking that the valve would close, not that each circuitwould close the valve; f) design blowdown times for bothindividual vessels and overall systems which had never beenverified by plant trials.

Plant Protection SystemsUse of control valves as shutdown/ isolation valves. Onsome installations, control valves were also being used forshutdown/isolation purposes as an alternative to installingseparate dedicated shutdown and isolation valves. This isconsidered to be very poor practice in that: a) it may be aninitial failure of the control valve, that necessitates operationof the shutdown valve. 'Doubling up' on the duties clearlyincreases significantly the possibility of common causefailure; b) control valves are not designed for tight shut-offand any leakage could contribute toward the escalation of anincident.

Common tapping points for control and shutdowndevicesTrip tappings should always be independent of those usedfor the primary controller to avoid the possibility of commoncause failure if the tapping line should become blocked ormechanically isolated. Instances where this was not the caseand common tappings were employed were found on 3installations. Again, this is very poor practice. For example,the possibility of gas blowby on one installation

was greatly increased due to the low level alarm and low lowlevel trip being taken from the same tapping as the primarylevel controller.

Unlocked bypass valves around shutdown valvesShutdown valves are frequently fitted with bypass valves topermit their removal for maintenance purposes or to preventexcess differential pressure across the valve seat. However ifthe purpose of the associated shutdown valve is not to beseriously compromised, it is essential that the bypass valvesare closed in normal operation. This is usually achieved bylocking them and placing them on the locked valve register.On several installations, bypass valves were not lockedclosed and on 2 installations bypass valves were found to beopen. Figure 1 below shows a typical bypass arrangement asshown on a P&ID.

Fig 1

No register of trip and alarm settingsDuring plant design, settings are specified for alarms andtrips to allow adequate time for intervention before a seriousincident develops. A register of these settings should beavailable on the installation. During commissioning, or in thelight of operating experience, these settings may be changedto achieve optimal performance (for example, changes maybe made if frequent spurious trips are found to occur).However any changes need to be risk assessed, subject toformal approval and recorded on the register. For mostinstallations this proved to be the case but there wereinstallations which: a) had no register of selected settings; b)where changes could be made by control room staff, whichwere not formally recorded and were not reviewed bysupervisory staff.

Long-term process alarm faultsProcess alarms are incorporated within a design to try toprevent the development of serious process upsets. Alarmsshould therefore normally be in a working state and wheredefective should be repaired as rapidly as possible. If this isnot possible, a formal assessment of the effects of prolongedoperation without the alarm(s) should be carried out. Onsome installations, there were alarms which had clearly beenout of action for a long period of time, without anyassessment of potential consequences having been carried

out.

Common alarms to different locationsIndividual process systems, (eg gas compression) aresometimes designed to operate with a local control panelwith some alarms relayed to a central control room (CCR).In general such arrangements can work well if appropriateattention is paid to the alarm provisions in the centralfacility. Particular problems identified were: (a) systemswhich only had 'common' alarms in the CCR, providinginsufficient detail as to the nature of the fault condition.More detailed diagnosis required dispatch of an operator tothe local control panel. Safety critical fault alarms shouldalways be repeated in both locations; (b) where the receiptand acceptance of a single fault condition in the CCR would'overwrite' the receipt of any further alarms from the samesystem.

Training and CompetenceEmergency training and procedures. Written proceduresdid not always cover process upset conditions or describewhat action should be taken under different processemergency conditions. This was an aspect also absent from anumber of the training and competence schemes where theemergency training element was focused on actions to betaken following a major incident rather than actions relevantto preventing a process upset developing into a majorincident.

Familiarity with key risk areasA knowledge of the principal sources of risk on aninstallation may assist in modifying the behaviour ofpersonnel such that increased care and attention will be takenwithin 'higher risk' areas such as gas compression and with'higher risk' activities . However, although the key risk areason different installations had been identified duringpreparation of the Safety Case, this information had notalways been successfully conveyed to operations personnel.

Lack of adequate handover of specialist processpackagesTypical process plant will incorporate a number of specialistpackages, (eg gas compression units) which will normally becommissioned by the manufacturers own teams. Evidencefrom the audits indicated that whilst platform staff weremeant to be involved in this work to gain familiarity with theequipment, they were sometimes seen as 'in the way' andslowing down progress and hence discouraged from detailedinvolvement. This had resulted in packaging being handedover to process personnel with only a limited knowledge ofhow to operate them. One company had had two loss ofhydrocarbon containment incidents in quick successionattributable to operator unfamiliarity.

Training and competence programmesSome training and competence programmes were in theprocess of being developed or upgraded. In general, whilstvery good training programmes appeared to be in place fornew recruits, there sometimes appeared to be gaps present

for more established staff as well as for supervisors. Forexample: a) instances were found where establishedoperators did not have a good understanding of aspects ofthe plant they were operating, eg the importance and role ofinstalled High Integrity Protection Systems (HIPS). In suchcases, there appeared to have been an underlying assumptionby management that no further formal training was requiredby experienced personnel and consequently competenceassessment had become largely a 'paper' exercise to confirmthis belief; b) competence programmes frequently did notextend to supervisors themselves.

OrganisationInterface management. A number of the installations hadfairly complex operational arrangements with, for example:a) the dutyholder sub-contracting out significant parts of theoperational and maintenance functions; b) the asset ownercontracting out responsibility for production to another partywho took over the role of dutyholder. Whilst in general these arrangements seemed to work well,it was found that in some areas relative roles andresponsibilities were inadequately defined, with resultant safety implications. For example, on one installation, whilstthe bulk of maintenance work had been sub-contracted out,this did not include part of the testing functions (ESDVs etc).However, this fact was not clear to the relevant personnelwho were meant to have been responsible for the work.

Manning levelsOn some installations there was an absence of formalprocedures requiring reviews of manning levels, even thoughthere could have been significant changes in workload due tofactors such as the addition of new units/tie-backs etc. In onecase this has led to serious concerns that process operatorswere overloaded, with potential safety implications.

InvestigationIncident close-out. Whilst thorough investigation of allincidents and releases was a feature common amongst thedutyholders, a number of instances were found where agreedremedial actions still had not been implemented aconsiderable time after the investigation had concluded. It appeared that the actions had essentially become'forgotten about' in the absence of a formal incident accidentclose-out procedure.

Detailed Design IssuesInaccurate drawings and other process information. Onthe majority of older installations the accuracy of some ofthe Piping and Instrument Drawings (P&IDs) was uncertainand it was accepted that there were probably areas wherethey did not reflect the actual situation. Although alldutyholders had in place procedures for recording newengineering work, the problem arose as a result of the manymodifications which had taken place over the years, some ofwhich had not been properly recorded on updated drawings.

This situation can have serious consequences if, for example,process isolations are to be based on inaccurate drawings andresult in an unforeseen release of hydrocarbon. The remedyrequired dutyholders to carry out detailed checks of existingdrawings against the actual plant. Some dutyholders weremaking progress in this area but others appeared not to beaddressing the problem. Similar considerations applied to awide range of design data including cause and effectdrawings, control data sheets etc and even extended todocuments such as 'basis of change/design philosophy' whichon occasions had not been updated despite significantmodifications having occurred. Again, the danger was thatsomeone might use these outdated documents as an inputinto a safety critical decision.

Inadequate vetting of design modificationsThe importance of proper control of engineering designchanges is widely recognised and most dutyholders have inplace detailed procedures to cover the issue. However, for afew companies, the procedures were still not sufficientlyrobust and evidence was found of significant changes withsafety implications being agreed and implemented byoffshore personnel without the detailed knowledge andagreement of onshore design staff.

Hazard and Operability (HAZOP) StudyShortcomingsHAZOP studies are routinely carried out on all new plantand major modifications. However, amongst the problemsidentified with such studies were: a) HAZOP actions notclosed out. The principal findings from a HAZOP willnormally be summarised in some form of HAZOP ActionRegister. This will record the nature of the problem, how/bywhom/when it is to be further addressed, the nature of thesolution agreed and confirmation that this solution has beenimplemented. When these details have been provided theaction can be formally closed and 'signed off'. However inseveral instances there had been no close-out and actionsremained uncompleted and problems unresolved; b) withmodifications it is important that the scope of the HAZOPincludes not only any new plant and equipment but alsoaddresses possible interaction with existing plant. Instanceswere found where the latter aspect had not been adequatelyaddressed.

Inadequate examination of HP/LP interfacesA number of major accidents onshore and incidents offshorehave occurred where there has been accidental breakthroughfrom a high pressure system to one at a lower pressure.Whilst the possibility of such events should be consideredduring the normal HAZOP process, because of theimportance and history of related incidents, it is consideredbetter practice to carry out separate, specific HP/LP interfacestudies. One dutyholder had not carried out any study of thisnature and indicated the belief the issue would have been

addressed by the HAZOPs. However detailed scrutiny of theHAZOP records indicated that the issue had not beenadequately addressed.

Inadequate blowdown evaluationBlowdown is an important feature of process plant design,allowing the plant to be rapidly depressurised in the event ofa developing emergency. Although the concept is simple,design of a blowdown system can be complex when there area number of potentially interfacing flows. Blowdownsystems are normally designed to the recommendations ofAPI RP 521, Guide for Pressure-Relieving and DepressuringSystems. The recommendation for depressurisation is todepressure from the initial conditions to 50% of the vessel'sdesign gauge pressure or to 6.9 barg, whichever is the lower,within 15 minutes. This recommendation is based on a vesselplate thickness of 1 in. Calculations should have been carriedout to establish whether the process vessel wall will fail,under fire conditions, in less than 15 minutes. If this were tobe the case, the blowdown rate should have been increasedaccordingly or other protective features such as passive fireprotection provided. Many light hydrocarbon liquids willchill to low temperatures as pressures are reduced. Designand depressuring conditions should consider this possibility. Problems identified during the audits were: a) no computedblowdown pressure v's time profiles for the process plant(where available, they frequently had not been checkedagainst plant trials, b) additional items of processequipment/changed operating conditions being incorporatedwithout their effect on the overall blowdown system beingaddressed.

Relief valvesMany items of process equipment are fitted with relief valvesto protect against overpressurisation. Relief valves are sizedagainst specific design conditions and if these conditionschange the valve may not be adequate for the new duty.Conditions may change either because of plant modificationsor changed operating parameters, (eg increased water cut).Several instances were identified where relief valve capacityhad not been reviewed although the required duty hadchanged. Also the design case and duty used in the sizingcalculations should be clearly specified on the relevant datasheet. Examples of process data sheets were sighted wherethis was not the case.

High integrity protection systems (HIPS)HIPS are frequently encountered on offshore installations.Properly designed and engineered they can provide effectiveprotection against different potential accident sequences.Considerable care needs to be employed in the design andinstallation of HIPS requiring the involvement of specialiststaff. However instances were identified where this had notbeen the case. For example, a HIPS had been installed toprevent line overpressurisation on a compressor bypass.When the system was examined by the auditors, it was clearthat, with the size of valve installed, the required valveclosure time of 30 seconds could not be achieved.Consequently, the line would have become overpressurised

and the dutyholder had to amend the design.

Threaded pipe connections on hydrocarbon dutiesThe use of threaded pipe connections on hydrocarbon duties,other than for small bore instrument fittings, is not regardedas good practice and piping codes such as ANSI B31.3would only allow their usage under very restrictedcircumstances. In recognition of this, on older installationswhere a number of such connections may have beenprovided with the original design, dutyholders will normallyhave tried to replace or back-weld them. However, on2 older installations, sections of pipework with threadedconnections were found. On one there had been a policy ofback-welding but a number of connections had been missed;on another the original piping specification had not beenupdated and was still shown as 'current'.

Higher Level Design IssuesPolicies and standardsReview of standards on older installations. Olderinstallations were often designed to standards (company,national, international) which have since been supersededand are no longer seen as appropriate. This has resulted inthe absence of some safety features, (eg blowdown systems)which the dutyholders themselves would view as highlydesirable (or even mandatory) for any of their newerfacilities. Similarly operating parameters (reservoircomposition, water cut, pressures etc) on older installationsmay have changed significantly over time resulting inoperating conditions going outwith the original designenvelope. However, several dutyholders did not have anypolicy as to whether older facilities should be reviewedagainst current standards/good practice and against changedoperating parameters in order to determine whether areascould be identified where upgrades in either equipment oroperating practices would be beneficial.Figure 2 below shows the arrangement found on an offshoreinstallation which had been operated since the mid 1970’s. Itclearly shows that gas breakthrough to the vent system couldeasily have occurred if there had been a level controlproblem with the separator.

Company design standardsSeveral of the dutyholders did not have any companypolicies regarding design standards but rather relied onproject standards which were agreed for a given project bythe company's design team and any associated contractor.The effect of this can be that particular dutyholders may beoperating a number of facilities each with different standardsand that this can cause problems (some with safetyimplications) if staff are transferred between installations andare unaware that these differences exist. This appeared to bethe case for some dutyholders.

Review against identified problem areasThere are areas of plant operation which are known to giverise to a disproportionate number of hydrocarbon releases.For example, from incident returns reported to OSD, it canbe readily identified that a high proportion of gas releasesemanate from small bore piping and instrument fittings. As aresult, some companies had conducted campaigns to try toimprove their performance in this area by seeking tominimise the amount of such pipework and fittings andimprove the standard of related maintenance. However,several of the companies audited did not have any policywith regard to the identification and review of problem areas.

Inherently safer design principlesThe majority of dutyholders had no formal policy toward theadoption of inherently safer design principles; whether theseimportant principles were considered or not was essentiallyat the discretion of the design teams concerned.

OrganisationLack of relevant 'in-house' engineering expertiseAs a result of downsizing some dutyholders did not havein-house expertise for all process-related engineeringdisciplines and had to outsource some requirements. Sucharrangements did not always produce satisfactory results,especially where there was not even sufficient expertise tomonitor the work of the external contractor. For example: a)on behalf of one dutyholder an external process designconsultant submitted relief valve sizing calculations to OSDwhich were clearly in error. The calculations were shown asbeing approved by the dutyholder although they had no'in-house process engineer; b) significant problems wereencountered with a compressor control system on oneinstallation. The problems could have been identified at thedesign stage by a competent control engineer but thedutyholder did not have one in post at the time.

ConclusionsThe Health and Safety Executive undertook this series ofaudits in the light of concerns over the number of loss ofhydrocarbon containment incidents which were beingreported each year from installations in the UKCS. Thefindings highlight areas of process operation whereadditional management effort by dutyholders may bebeneficial in securing better compliance

LIC

LCV

VENT

SUMP TANK

SEPARATOR

GAS / WATER IN GAS OUT

Fig. 2

with UK health and safety legislation and in reducing thelevel of offshore risk. It is hoped that the findings will act asa catalyst for companies to review their own systems andarrangements in these areas and satisfy themselves that theproblems discussed are not applicable to their ownoperations. OSD will also seek to examine these areasfurther by means of their own inspections.References1. Successful health & safety management, HS(G)65, HSE

Books 1997, ISBN 0 7176 1276 7.