HEMP - PDO

middleweightscourgeUrban and Civil

Nov 29, 2013 (3 years and 11 months ago)

292 views

Shell
International Exploration & Production B.V.

Revision 0: 16 October 1995



Overview Hazards
and Effects
Management
Process



EP 95
-
0300






HSE

MANUAL

EP HSE Manual Amendment Record Sheet

Section Number
:

EP 95
-
0300

Section Title
:

Overview Hazards and Effects Management Process

Rev


No.

Chapter
Nos.

Description to
amendment

Date

dd/mm/yy

Amended by

0

All

Original hard copy and CD
-
ROM issue *

16/10/95

EPO/61









































* In this publication, some of the figures have been colour enhanced. This was done after the issue of the CD
ROM.
The next issue of the CD ROM will include these enhancements. There is no difference in content.


Contents

EP 95
-
0300 Revision 0: 16
October 1995

i

Contents

1

Introduction

1

1.1

Elements of the HSE Management
System

1

1.2

Tools for the Hazards and Effects
Management Proc
ess

2

1.2.1

Selection of tools

2

1.2.2

Application and competence

2

2

Hazards and Effects
Terminology

3

2.1

Hazards, Effects and Incidents

3

2.2

Threats and Barriers

4

2.3

Consequences, Mitigation and
Recovery

Preparedness Measures

4

2.4

Risk

8

2.5

Fault and Event Trees

9

2.6

Likelihood and Consequence (or
Effect)

9

3

Hazards and Effects
Managem
ent Process (HEMP)

11

3.1

The Steps in the Process

11

3.2

Implementation of HEMP

12

3.2.1

Assets: planning and review

12

3.2.2

Activities: planning and

review

13

3.3

Approaches to the Hazards and
Effects Management Proc
ess

13

3.3.1

Experience/judgement

14

3.3.2

Checklists

14

3.3.3

Codes and standards

14

3.3.4

Structured review

techniques

15


4

Structured Review

Techniques

17

4.1

Identify Hazards and Potential

Effects

17

4.2

Evaluate Risks

19

4.2.1

Scenario development

(causes)

20

4.2.2

Probability

20

4.2.3

Consequence analysis

20

4.2.4

Determination of risk

22

4.2.5

Quantitative Risk

Assessment (QRA)

22

4.2.6

Screening criteria:
limits/standards

26

4.3

Record Hazards and Effects

26

4.3.1

Records

26

4.3.2

Hazards and effects register

26

4.3.3

Manual of Permitted

Operations (MOPO)

27

4.4

Compare with Objectives and
Performance C
riteria

27

4.5

Establish Risk Reduction

Measures

27

4.5.1

General

27

4.5.2

Control of release of hazards
and effects

27

4.5.3

Recovery preparedness
measures

28

Appendix I Activities: Planning

and Review HEMP Tools and
Techniques

30

Appendix II Assets: Planning

and Review HEMP Tools and
Techniques

31

HSE Manual

EP 95
-
0300 Overview Hazards and Effects Management Process

ii

EP 95
-
0300 Revision 0: 16 October 1995

Appendix III Hazards and Effects
Hierarchy

33

Appendix IV Structured Review
Techniques Summary Description
Sheets

52

Appendix V Example of Further
Definition of Consequence
-


Severity Rating for Risk Matrix

74

Appendix VI When to use QRA

76

Glossary

78

References

81





1 Introduction

EP 95
-
0300 Revision 0: 16
October 1995

1

1

INTRODUCTION

Volume 3 of the EP HSE manual is concerned with the tools and techniques which are available to
achieve the management of HSE issues. It is a first referenc
e for all those involved in EP business
activities particularly those who are responsible for the management of hazards and their effects.

The objectives of Volume 3 are to:



provide a general overview of the Hazards and Effects Management Process



descr
ibe the tools and techniques most commonly used in Shell EP



assist in the selection of the appropriate tools and techniques



provide guidance on the integrated application of the tools and techniques and outline how the
results are to be incorporated wi
thin the HSE Management System.

This document, EP 95
-
0300, provides an overview of Volume 3 and describes:



the need, within the context of an HSE Management System, to define both the techniques and
tools commonly in use together with the competencies re
quired for their effective application



the more common terminology and concepts used in the analysis of hazards and effects and the
determination of risk



the stages of the Hazards and Effects Management Process and its role within the HSE
Management Sy
stem. The role of experience, codes and standards, checklists and structured
techniques are discussed



in summary the various structured review techniques available in Shell to support the process.

1.1

Elements of the HSE Management System

The HSE Management System contains the following elements which are described fully in
Volume

1.



Leadership and Commitment



Policy and Strategic Objectives



Organisation, Responsibilities, Resources, Standards

and Documents



Hazards and Effects Management Process (HEMP)



Planning and Procedures



Implementation and Monitoring



Audit



R敶i敷

T桥⁈慺慲摳d慮搠affe捴s⁍慮ag敭敮e⁐牯 e獳 (H䕍E)⁩猠捥ntr慬 t漠t桥⁥ff散tiv攠em灬em敮e慴i潮f

t桥⁈h䔠E慮ag敭敮e⁓ 獴敭⸠.桥⁰h潣os猠sn獵s敳 th慴⁨慺慲摳⁡湤⁰nt敮tial⁥ff散ts⁡ 攠eully
敶慬畡u敤⸠T漠o漠ohi猠t桥h畳u⁦ir獴⁢攠ed敮eifi敤⁴h敮⁡ 獥獳敤⁡湤 t桥hitig慴io渠慮搠n散潶敲y
灲数er敤湥ns敡獵s敳⁰畴 i渠灬慣攠t漠r敤e捥 t桥⁣潮獥煵敮qe猠潦

慮a⁲敭慩湩湧⁲i獫⸠.漠o捨c敶攠e桩猠
愠湵a扥b t潯l猠sn搠d散桮i煵敳⁡ 攠畳敤⸠T桥獥⁡r攠e敳捲i扥搠d渠thi猠Vol畭攮

(Specific guidance on when to use the techniques within various business activities is given in
the relevant sections of Volume 2, e.g.
EP 95
-
0230

Design,
EP 95
-
0220

Appraisal and
Development, etc.)

HSE Manual

EP 95
-
0300 Overview Hazards and Effects Management Process

2

EP 95
-
0300 Revision 0: 16 October 1995

1.2

Tools for the Hazards and Effects Management Process

1.2.1

Selection of tools

The objectives set out in the HSE Management Systems (HSE MS) and subsequently the HSE Case
effectively become the acceptan
ce criteria for the risk determined in the hazards and effects
management process. There are many publications and documents available describing tools and
techniques for hazards and effects management some of which are marketed commercially. These
techniq
ues are often developed in isolation and may be inappropriate for use within EP. They may
also be unnecessarily time consuming, not cost effective or may overlap.

This document is designed to identify, specify and aid the effective selection of an integrat
ed suite of
tools and techniques. Most of these have been in use for some time. The various tools and techniques
have been collated for ease of reference, to demonstrate their relationship to each other and to
describe their input to the HSE MS and HSE Cas
e. As stated above this document does
not

specify
when to use the tools, this is done in the documents describing the business activities. A very broad
framework of tools, techniques and guidelines used in hazards and effects identification and
assessment
during the life cycle is provided in Appendices I and II.

Codes, standards, checklists, as well as individual experience and judgement are in no way replaced
by any of these techniques and continue to play a vital role.

1.2.2

Application and competence

Successful application of a technique is largely dependent on the experience of the personnel using it.
For this reason, familiarity, competence and training are important factors to be taken into
consideration

when planning and resourcing projects and drafting contract specifications. The
competence levels required to operate these techniques effectively may then be identified and the
relevant resources secured.

The application of tools in the hazards and effec
ts management process such as Environmental
Assessment, Health Risk Assessment and QRA will continue to involve specialists but their output
can now be brought together with other studies in a common HSE Management System. Specialist
assistance when using
other tools and techniques may also be necessary. However the successful
application of any tool and technique will always be dependent on the participation of the staff
involved in the activities under study. Most of the tools described require a multi
-
di
sciplinary
approach.

Health, Safety and Environmental Management is no different from any other aspect of EP business
and remains a line responsibility. HSE therefore falls under the same management and management
system. H, S and E have been considered to
gether in this document although external reasons may
exist for presenting certain studies separately. For example, when two separate authorities deal with
safety and environmental

2 Hazards and Effects Terminology

EP 95
-
0300 Revision 0: 16
October 1995

3

2

HAZARDS AND EFFECTS
TERMINOLOGY

This chapter provides an overview of the more common terminology and concepts used in the
analysis of hazards and effects and the determination of risk.

A comprehensive list of terms and their definitions is provided i
n the glossary of this document.

2.1

Hazards, Effects and Incidents

A
hazard

is defined as:

'The potential to cause harm, ill health or injury, damage to property, plant, products or the
environment, produ
ction losses or increased liabilities'. This definition can be extended to include
social/cultural disruption.

This represents a specific use of the word hazard which in more common usage can mean danger,
chance or risk. Risk is defined in
2.4
. It is important to recognise the adopted definition of this basic
term and to be consistent when using common techniques. Hazards should not be confused with
hazardous activities (e.g. drilling). Examples of hazards are: hydr
ocarbons under pressure, objects at
height , electricity.
Appendix III

contains a listing of generic hazards.

The terms 'chronic' and 'acute' are introduced in Volume 1 and are used to differentiate between
hazards and effects as
sociated with continuous discharges and occupational exposure (prolonged) and
those relating to one off events, (health, safety and environmental incidents) which might include
poisoning, oil spills, fires and explosions.

In environmental terms, 'chronic'
effects

are sometimes referred to as 'routine' and are defined as the
result of planned emission or discharge to the environment. Such releases may include flaring of gas,
or discharge to sea of produced water following repeated and prolonged exposure to r
elatively low
levels or concentrations of a hazardous agent.

The aim is to control all health and environmental hazards and effects within defined limits. For
health, for example, controls for benzene define levels in air for long term exposure. For enviro
nment,
for example, controls for flaring may include limiting the volume of gas disposed of, defining criteria
for the combustion efficiency and defining environmental quality standards for combustion products.
Similarly, control of noise emission will be
based on noise limits which will be set for a given
location.

An effect in the context of this manual is usually an adverse effect either on the health or safety of
employees or the public. An environmental effect is any direct or indirect impingement, whe
ther
adverse or beneficial, upon the environment of the activities, products and services of the company.
This also includes impact on social and cultural systems.

The undesired release of a hazard is a hazardous event. If the hazardous event is the first
event
resulting from the release of a hazard then it is called a 'Top Event'. This is the undesired event at the
end of the fault tree and at the beginning of an event tree (see
2.5
). In the context of environmental
routine haza
rds, the undesired event can relate to the breaching of defined limits, such as oil in water
discharged to sea or noise levels in and around locations, or in the context of health hazards, this
relates to exceeding occupational exposure limits and other st
andards for the full range of agents
hazardous to health.

An
incident

is an unplanned event or chain of events which has caused or could have caused injury,
illness and/or damage (loss) to assets, revenue, the environment or third parties. An incident invo
lves
the release or near release of a hazard which includes the exceedance of defined limits.

HSE Manual

EP 95
-
0300 Overview Hazards and Effects Management Process

4

EP 95
-
0300 Revision 0: 16 October 1995

2.2

Threats and Barriers

A
threat

in the context of this document is something that could potentially cause the release o
f a
hazard and result in an incident. Examples of these causes or threats are corrosion, fatigue damage,
poor visibility, overpressure, lack of knowledge/competence, etc.

To prevent a threat or combination of threats ultimately resulting in the release of
a hazard, some kind
of countermeasures are necessary. These measures are called
barriers.

In the case of corrosion as a
threat, for example, appropriate barriers could be a corrosion
-
resistant coating, inspection
programmes or corrosion allowances. For ove
rpressure one barrier would be a pressure relief system.
Environmental barriers could include operational controls, e.g. traffic restrictions for noise, or
hardware controls, e.g. provision of water treatment equipment. Health barriers include, for example

local exhaust ventilation (LEV) and PPE.

Barriers may be physical (shields, isolation, separation, protective devices) or non
-
physical
(procedures, alarm systems, training, drills).

2.3

Consequences, Mitigation and Recovery Preparedness
Measures

Should the barriers fail to prevent or avoid the release of a hazard then some kind of counter measures
are required to limit the
consequences

of the hazardous event or effect. The purp
ose of these
countermeasures is the
mitigation

of consequences and to aid in reinstatement. One example of
mitigation is a fixed fire protection system, another would be the evacuation of personnel from the
area. Those measures aimed at reinstating or retu
rning the situation to a normal operating condition
are also called
recovery

preparedness

measures
. All such measures ranging from the first steps in
mitigation through to reinstatement of the operation are termed recovery preparedness measures.

2 Hazards and Effects Terminology

EP 95
-
0300 Revision 0: 16
October 1995

5

Figure
2.1

Terminology: acute or incidental release (safety example)


Inspection
Corrosion
Allowance
Detection
Process
Shutdown
Detection
ESD
Plant
Separation
Detection
and
Deluge
Leak !
First Hazardous Event
or
Top Event
Hazardous
Event
Fire
Fire
THREATS
ESCALATION
Hazard :
Hydrocarbon gas
under pressure
Examples:
Corrosion
Erosion
Impact
CAUSATION
Threat Barriers
Recovery Preparedness Measures
and Mitigation Measures
CONSEQUENCE
Rupture and Leak
Pressure Vessel
HSE Manual

EP 95
-
0300 Overview Hazards and Effects Management Process

6

EP 95
-
0300 Revision 0: 16 October 1995

Figure 2.2

Terminology: chronic or routine release (environmental example)


Auto Level
Alarm
Procedures
Sampling
Alarm System
Shutdown
Divert to
Holding
Tanks
Plant
Shutdown
Clean-up
Plan
Discharge
ppm Limit Exceeded !
First Hazardous Event
or
Top Event
Hazardous
Event
Pollution
THREATS
ESCALATION
Hazard :
Effluent

Examples:

Input Changes

Maloperation

Malfunction
CAUSATION
Threat Barriers
Recovery Preparedness Measures
and Mitigation Measures
CONSEQUENCE
Pollution
Treatment system
Discharge

Ecological damage

Water supply contamination

Irrigation contamination

Liabilities

Reputation
ppm
ppm
Limit
2 Hazards and Effects Terminology

EP 95
-
0300 Revision 0: 16
October 1995

7

Figure 2.3

Terminology
-

Chronic or Routine Release (Health Example)


Vapour Return
System
Local
Exhaust
Ventilation
PPE
Biological
Monitoring
Epidemiology
Exposure to benzene
exceeding OEL* !
First Hazardous Event
or
Top Event
Increased risk :
Leukaemia
Liabilities
Loss of reputation
THREATS
ESCALATION
Hazard:
Toxic vapour
Examples:
Corrosion
Maloperation
Leaking flanges
CAUSATION
Threat Barriers
Recovery Preparedness Measures
and Mitigation Measures
CONSEQUENCE
Release of benzene
Increased
risk of
leukaemia
ppm
ppm
Limit
Procedures
Handling of toxic chemical
* OEL Occupational Exposure Limit
HSE Manual

EP 95
-
0300 Overview Hazards and Effects Management Process

8

EP 95
-
0300 Revision 0: 16 October 1995

Figure 2.4

Cause consequence diagram (bo
w tie)


2.4

Risk

‘Risk’

is the product of the probability that a specified undesired event will occur and the severity of
the consequences of the event. To determine the
‘risk’

of a specific
‘hazardous event’

taking place
therefor
e requires information on the likelihood of the event taking place and the severity of the
adverse consequences that could be expected to follow from it.
Risk

is a term which combines the
chance that a specified undesired event will occur and the severity
of the consequences of the event.

To determine the risk associated with a specific 'hazardous event', information is therefore required
on the chance of the event taking place and the severity of the consequences that might be expected to
follow from it. R
isk is sometimes also defined as the product of probability and the severity of
consequences.

The terms 'probability', 'likelihood', 'frequency' and 'chance' are often used interchangeably however
in the HEMP terminology, the following apply and should be
consistently used:



l
likelihood and chance both indicate the possibility of something happening



frequency is a rate, e.g. number of incidents per hour



probability is a ratio

It indicates the number of chances of something happening to the total number

of chances.

2 Hazards and Effects Terminology

EP 95
-
0300 Revision 0: 16
October 1995

9

2.5

Fault and Event Trees

A common way of understanding the possible threats or causes that could lead to the unplanned
release of a hazard is to present them diagrammatically using a
fault tree
. In a
similar way after the
release of a hazard an

event tree

may be used to determine and display the potential outcomes or
consequences.

Fault Tree Analysis is used to show the sequence of possible threats or causes that could lead to the
release of a hazard.
The fault tree leads to a single point where the undesired event has taken place or
where the hazard has been released. This is known in risk assessment terms as the Top Event and
represents the transition from the Fault Tree (threats/causes) to the Event
Tree (consequence).

The Event Tree is made up of nodes which correspond to the different stages in an escalating incident
sequence. The lines which lead out of each node correspond to the paths of success or failure in
mitigation of the incident.

The whole

sequence showing the progression from any cause, (Fault Tree) through the Top Event to
the full range of consequences (Event Tree), for a single hazard can be represented in a single
diagram (often called a 'bow tie') as shown in Figure 2.4. In a quantita
tive assessment such as QRA, a
number of hazards will be considered together, however in qualitative assessment it is normal to
consider one hazard or one bow tie.

For qualitative and quantitative risk assessment the same process is used (i.e. bow tie) but

in QRA,
risks are quantified initially per Top Event then summated for a number of scenarios and hazards.

2.6

Likelihood and Consequence (or Effect)

The

Likelihood

of a Top Event occurring may be
determined by quantitative evaluation of the
possible threats or from historical data bases.

Lack of good data may limit the development of a fault tree however in some circumstances the
historical frequency of the top event may provide an adequate timate.

Consequence analysis

can be applied to assess HSE aspects for a range of scenarios and typically
involves the use of predictive models. Examples include the use of:



灨p獩捡l⁥ f散t猠s潤敬猠sor 灲敤i捴i湧⁴桥⁢敨 vi潵r⁡ 搠d潡oi湧
fr潭⁰潴e湴i慬⁨ 摲潣or扯渠
r敬敡s敳
摩s灥p獩o測⁦ir攬⁲a摩ati潮o⁥硰l潳i潮⁡湤⁳n潫攩⁩渠n敲m猠潦⁦l慭m慢a攠eimit猬⁨s慴
r慤a慴i潮Ⱐ數el潳i潮o敲pr敳獵r攬⁥tc



physical consequence models for predicting the consequence of the effects of hydrocarbon rele
ase
events (structural damage, vessel integrity loss, etc)



air and water dispersion models for predicting the behaviour of discharges to the atmosphere or
water bodies respectively

The tools and techniques used for both likelihood and consequence analysi
s are described in
Chapter

4
.

HSE Manual

EP 95
-
0300 Overview Hazards and Effects Management Process

10

EP 95
-
0300 Revision 0: 16 October 1995

This page intentionally left blank

3 Hazards and Effects Management Process (HEMP)

EP 95
-
0300 Revision 0: 16
October 1995

11

3

HAZARDS AND EFFECTS
MANAGEMENT
PROCESS (HEMP)

3.1

The Steps
in the Process

The Hazards and Effects Management Process (HEMP) was originally developed to provide a
structured approach to the analysis of safety hazards throughout the life cycle of an installation. The
envi
ronmental and health risk assessment processes fulfil a comparable function with respect to
environmental and health hazards at all stages of the life cycle. These assessments are based on the
same concept and have been brought together as HEMP. The proces
s is applicable to all business
processes in the life cycle of an operation from inception to abandonment. The tools and techniques
available are applied in a logical and rigorous way, setting acceptance criteria and screening against
them as the process p
roceeds. The arrangements identified as necessary to manage assessed threats
and potential consequences and effects are then incorporated in the design phase or for existing
operations it is necessary to verify that what is in place is suitable and suffici
ent. If not, then remedial
action is taken and all necessary procedures are incorporated into the HSE Management System.

The principles of 'identify', 'assess', 'control' and 'recover' are the basis of HEMP, with the individual
stages summarised in the fo
llowing steps:

1.

Identify Hazards and Potential Effects

2.

Evaluate Risks

3.

Record Hazards and Effects

4.

Compare with Objectives and Performance Criteria

5.

Establish Risk Reduction Measures.

Step 1: Identify hazards and potential effects

Systematically
identify

the hazards, the threats and potential hazardous events and effects which may
affect, or arise from, a company's operation throughout the total life cycle of the operation.

Step 2: Evaluate risks

Systematically evaluate (
assess
) the

risks from the identified hazards against accepted screening
criteria, taking into account the likelihood of occurrence and the severity of any consequences to
employees, assets, the environment and the public. This includes the risks associated with devi
ation
from limits set for environmental and occupational health hazards.

Step 3: Record hazards and effects

Record all those hazards and effects identified as significant in relation to the screening criteria in one
of the following documents:



HSE MS Act
ivities Catalogue



HSE Activity Specification Sheets



Hazards and Effects Register



H卅⁃riti捡l⁏灥rati湧⁐牯捥摵d敳



Manual of Permitted Operations.

These documents will then be included in Parts 3 and 5 of the HSE MS and HSE C
ase.

HSE Manual

EP 95
-
0300 Overview Hazards and Effects Management Process

12

EP 95
-
0300 Revision 0: 16 October 1995

Step 4: Compare with objectives and performance criteria

Compare the evaluated risks against the detailed HSE objectives and targets for the project or
installation. For all cases these targets must be maintained and be consistent with the Company
Pol
icy, and Strategic Objectives. Performance standards at all levels must meet the criteria set in the
HSE Case which in turn must comply with the Company's HSE Management System.

Step 5: Establish risk reduction measures

Select, evaluate and implement appro
priate measures to reduce or eliminate risks. Risk reduction
measures include those to prevent or
control

incidence (i.e. reducing the probability of occurrence)
and to mitigate effects (i.e. reducing the consequences). Mitigation measures include steps to

prevent
escalation of developing abnormal situations and to lessen adverse effects on Health, Safety and the
Environment. Risk reduction measures also include
recovery

preparedness measures which address
emergency procedures as well as restoration and com
pensation procedures to recover.

Revisit Step 3 to record fully the activity/task requirements.

3.2

Implementation of HEMP

The Hazards and Effects Management Process can be implemented at any point in the life cyc
le of a
facility or operation. When planning the development of new facilities, reviewing existing facilities,
or planning for the abandonment and decommissioning of existing facilities the focus is on the
identification and assessment of hazards and effec
ts that may be avoided, reduced or eliminated. In
the operational and maintenance phase, the focus is on control of hazards and effects by procedures
and the development and implementation of effective recovery preparedness measures. In the
abandonment and

decommissioning stages the focus is directed towards safe clean up and
rehabilitation.

People involved in operational activities however should always be alert to identify new hazards
particularly in non routine operations.

3.2.1

Assets:
planning and revi
ew

In a new development the HEMP will normally be iterative, beginning on a wide basis with little
detail and then progressing through the development cycle as more detail becomes available. In the
review o
f an existing development a similar iterative approach may be adopted starting with a wide
approach on general issues then converging on areas of specific concern and more detailed
assessments. This management process is applied to all hazards and potentia
l effects. Those engaged
in design and planning activities who utilise tools, such as HAZOP, Health Risk Assessment or
Environmental Assessment are already familiar with this approach.

Appendices
I

and
II

give an indication of when the tools and techniques are used during the life cycle
of a development and in the development of an HSE Case for an asset. Full guidance is provided in
the respective business activity guidelines such as
EP 95
-
0230

Design and Engineering
and EP 95
-
0220

Concept Development.

The output from the various tools and techniques used in the HEMP in the
planning and review stages
of a new development is used primarily to refine the design by identifying the hazards and threats,
removing them if possible and making the design as inherently safe to operate as practicable. The
output therefore primarily conc
erns the hardware although the design planning phase can profoundly
affect all subsequent stages of the development. Information from this work is included in the HSE
Case for an asset for use in the operational phase.

3 Hazards and Effects Management Process (HEMP)

EP 95
-
0300 Revision 0: 16
October 1995

13

3.2.2

Activities: planning and review

This relates to the preparation for practical physical activities involved in the implementation of
plans. In EP these activities include survey, drilling construction, operation, decommissioning, and
abandonment. This preparation should involve those carrying out or supervising the activity. The
techniques for the identification and assessment of hazards used in the planning and review stages are
also applicable but in the operational phase tend to be
more focused on procedural aspects rather than
hardware design.

In the implementation or operations phase, planning activities such as the systematic preparation of
Permits to Work and Job Hazard Analysis address all the steps of the HEMP.
EP 95
-
0315

describes
the basic Permit
-
to
-
Work System and
EP 95
-
0311

describes Job Hazard Analysis which can be used
for a team review of the

procedure for a repeated activity or as a one
-
off review of a new activity. The
computerised system THESIS (see
EP 95
-
0323
) can also be used to assess hazards and effects and
identify the n
ecessary controls.
EP 95
-
0270

‘General Workplace Practices’ contains activity
specification sheets and hazard register sheets for typical HSE activities and hazards encountered in
the workpl
ace. The Manual of Permitted Operation (MOPO) describes conditions where specific
activities cannot be carried out at the same time and is described in
EP 95
-
0310

Implementing and
Documentin
g an HSE MS and HSE Case. Waste management procedures, described in
EP 95
-
0390

Waste Management Guidelines, provide information for the inclusion of waste management
activities.

At the time
of writing this Guide, work is proceeding on the preparation of Generic HSE Cases for
activities such as drilling, seismic and transport. These are aimed at providing a basic 'starter kit'
HSE case containing all the common activities, procedures and cont
rols which can be subsequently
made 'site
-
specific' for local application.

The output from the various tools and techniques in the HEMP for operational
-
type activities will be
used in the development and review of working procedures and form part of the HS
E Case for the
operation of the facility. For a significant or new activity, such as a major construction project, a
seismic or drilling campaign or abandonment, the output from the various tools will be included in an
HSE Case.

For a smaller work scope us
ually confined to one contract the HSE Case is sometimes called an HSE
Plan or where the work or operational task is one of many to be undertaken, terms like 'Work
Procedure' or 'Work Statement' are sometimes used. All these descriptions only reflect the s
cale of the
operation. The most important point is that in their preparation the steps of the Hazards and Effects
Management Process must be followed. That is hazards and potential effects must be identified and
assessed and Control and Recovery Preparedne
ss measures must be developed and in place ahead of
time.

3.3

Approaches to the Hazards and Effects Management
Process

Hazards can be identified and assessed in a number of ways.
The hazard identification and assessment
process is based on the following:



數灥ri敮捥/j畤u敭敮e



捨c捫li獴s



捯摥猠慮搠at慮摡d摳



獴ru捴ural⁲敶i敷⁴e捨ci煵qs

HSE Manual

EP 95
-
0300 Overview Hazards and Effects Management Process

14

EP 95
-
0300 Revision 0: 16 October 1995

Figure 3.1

Approaches to the Hazards and Effects Management Process


3.3.1

Experience/judgement

The knowledge of experienced staff provides a sound basis for hazard identification and assessment.
One can draw on

experience gained from different aspects of the EP business in different locations.
Practical staff experience gained in the field and feedback from incidents, accidents and near misses
is invaluable.

3.3.2

Checklists

Thes
e are a useful way of ensuring that known hazards and threats have all been identified and
assessed. The use of checklists, however, must not be allowed to limit the scope of review. They are
normally drawn up from standards and operational experience and
focus on areas where the potential
for mistakes is high or where problems have occurred in the past. Hazard Registers taken from the life
cycle of previous developments are particularly useful as a basis for checklists. They should be
maintained throughout

the life of the development and include both the operational and abandonment
phases (Ref. 1).

Table VI.1 is a checklist called the Hazard Hierarchy which includes health, safety and environmental
hazards previously identified by Opcos. The checklist appro
ach is used in several techniques such as
HAZID, HAZOP and FIREPRAN for example.

3.3.3

Codes and standards

These reflect collective knowledge and experience, accumulated on the basis of national or
international op
erations. They generally focus on hazard assessment and control, since the hazard is
inherent and recognisable. Codes and standards usually contain information on hazards applicable to
a particular type of operation. The designer of a pressure vessel relie
f system, for example, can use a
DEP or ISO Standard to find detailed guidance on the relief cases that should be considered. In some
cases compliance with prescriptive standards alone will reduce risk to 'as low as reasonably
practicable'. Similarly, the
acceptability or otherwise of emissions or discharges to the environment or
Structured
Review
Techniques
Codes / Standards
Checklists
Experience /
Judgement
IDENTIFY
CONTROL
RECOVER
ASSESS
HEMP
Increasing level of detail
3 Hazards and Effects Management Process (HEMP)

EP 95
-
0300 Revision 0: 16
October 1995

15

release of agents harmful to health can be assessed by reference to environmental quality standards
and occupational health exposure limits. For environmental and occupational heal
th, the process
begins with an inventory of emissions and effects agents hazardous to health respectively.

Codes and standards can therefore provide guidance on all four steps of identify, assess, control and
recovery.

Where new or non
-
standard designs are

concerned, especially ones containing configurations with
multiple interfaces, it is unlikely that all the possible interactions can be identified using codes and
standards alone. In more complex facilities such as offshore process facilities, other hazar
d
management tools will be required.

3.3.4

Structured review techniques

The following chapters of this document describe the Structured Review Techniques and Procedures
in current use. Some of these techni
ques were initially developed for use in safety management others
have been specifically developed for environmental and occupational health management often using
similar principles as for safety management. One example is HAZID (Hazard Identification) an
d
another is HAZOP (Hazard and Operability Study). With interpretation, these techniques are also
capable of addressing emissions, discharges, waste generation and occupational exposure to
hazardous substances, etc.

Many of the techniques described in this

Volume also contain screening
and acceptance criteria for Controls.

HSE Manual

EP 95
-
0300 Overview Hazards and Effects Management Process

16

EP 95
-
0300 Revision 0: 16 October 1995

This page intentionally left blank

4 Structured Review Techniques

EP 95
-
0300 Revision 0: 16
October 1995

17

4

STRUCTURED REVIEW TE
CHNIQUES

Structured review
techniques are available for all phases of the 'identify, assess, control and recover'
process. The recommended techniques are presented in this chapter under the same headings as used
in Chapter 3, i.e.:



Identify Hazards and Potential Effects



Evaluate

Risks



Record Hazards and Effects



Compare with Objectives and Performance Criteria



Establish Risk Reduction Measures.

4.1

Identify Hazards and Potential Effects

The selection of the appropria
te techniques depends upon the information available and the phase of
the project or maturity of the operation. The development of a project is described further in Volume
2 of this manual.

For EP facilities, a generic Hazards and Effects Hierarchy has bee
n generated and is included in
Appendix III
. This provides a structured listing of hazards and effects and attributes which can be
used as a completeness check during hazard identification. The hierarchy provides the basis for a
computerised approach to the systematic identification and assessment of hazards and their effects.

Table 4.1

Techniques for planning and review of assets

Technique


Reference

HAZID (Hazard Identification)

A structured brainstorming technique that is
part
icularly useful in the early stages of a
development, either as a stand alone exercise or as
part of a more general review. The ‘prompt’ or
‘checklist’ approach guides the less experienced
and prompts the experienced. Success when using
the technique depen
ds upon a properly constructed
team being well managed and having the
opportunity to think beyond the checklist and
identify the unusual. The same technique can be
applied for health hazards associated with the
living environment (e.g. tropical diseases) a
nd
lifestyle (e.g. substance abuse).

EP 95
-
0312

Health Risk Assessment

Is used for identifying and assessing occupational
health hazards and the controls needed to manage
them effectively. Chemical, physical, biological,
ergonomic as well as psychological aspects of the
occupational environment are included.

SHSEC Guide

(Ref
. 2)

HMSO publication
(Ref.
3
)

Health Risk Assessment and
Exposure Evaluation for Chemical
Agents

Supplements the general guide on Health Risk
Assessment (Ref.
4
) by providing specific
additional advice o
n assessing risk to health arising
from chemical agents in the work place.

SHSEC 1995

(Ref.
4
)

HSE Manual

EP 95
-
0300 Overview Hazards and Effects Management Process

18

EP 95
-
0300 Revision 0: 16 October 1995

Table 4.1

Techniques for planning and review of assets (continued)

Technique


Reference

Human Factors

Encompasses a number of
techniques directed at
the assessment of the human element of the
management of hazardous events from design
through to emergency response.

EP 95
-
0324

Environmental Assessment (EA)

Includes

development of an environmental profile
which provides information necessary to:



build an environmental description of the area
or location and its environment before
development



assess the

beneficial and/or adverse effects of
the development



identify mitigation measures



prepare a plan to enable measures to be
implemented

Also applicable to ongoing activities.

EP 95
-
0370

Soil and Groundwater Guides

Provides guidance on assessing soil and
groundwater quality at EP locations from initial
desk studies to more detailed site investigations.

EP 95
-
0385

EP 95
-
0386

EP 95
-
0387

Social Impact Assessment

Describes t
he component parts of a social impact
assessment including relationship to the natural
environment, cultural and historical attitudes and
sensitivities, population characteristics and political
social institutions. Means to involve the wider
public are see
n as critical.

EP 95
-
0371

HAZOP (Hazard and Operability
Study)

One of the most widely accepted and powerful of
the hazard identification and assessment tools
available for reviewing the des
ign of process
facilities. It is carried out in varying degrees of
detail throughout a project after design checks have
been completed. HAZOP is not a design tool but a
supplementary team checking exercise which also
includes the operational aspect of a de
sign.

It is unusual to make other than a subjective
assessment of the consequences of a particular
failure scenario during a HAZOP. The HAZOP
technique has been extended with success by others
to areas like maintenance, drilling, etc.

EP 95
-
0313

FIREPRAN

To identify deficiencies and opportunities for
improvement in order to meet objectives with
respect to fire and explosion management.
FIREPRAN is not suited to complex,
compact
integrated facilities.

EP 95
-
0350

4 Structured Review Techniques

EP 95
-
0300 Revision 0: 16
October 1995

19

Table 4.1

Techniques for planning and review of assets (continued)

Technique


Reference

SAFOP (Electrical Safety and
Operability Study)

Comprises

three components:



SAFAN
-

(Safety Analysis) identification of
hazards to personnel in the vicinity of
electrical systems



SYSOP (System Operability) critical
assessment of electrical
network and plant
design



OPTAN (Operational Task Analysis) analysis
of operator actions to determine areas of
potential operator error.


DEP (under
preparation)

(Ref.
5
)

Refer to SIPM

There are few if any tool
s and techniques which are limited solely to the identification of Hazards and
Potential Effects. Most include assessment as well as identification. Indeed techniques, such as Health
Risk Assessment and Environmental Assessment include all four elements,
i
dentify
,
assess
,
control
and
recover
.

Inherent in some techniques, such as HAZOP, is a qualitative assessment of risk based on judgement
of threats, such as hardware failure, control system failure, human error, corrosion, extreme
conditions, etc.

Table 4.
2

Techniques primarily for activity planning and review

Technique


Reference

Job Hazard Analysis

Identification of potential problems within a job
task that could lead to hazardous situations.
Elimination or reduction of the hazard by
development of safe
working procedures.

EP 95
-
0311

Tripod
-
BETA

To facilitate accident or incident investigation and
analysis by providing the means to assemble and
manipulate investigation information into a l
ogical
structure consistent with the Tripod accident
causation model and the hazards and effects model
of SMS (HSE MS).

EP 95
-
0321

Tripod
-
DELTA

The proactive identification of potential lat
ent
failures that could lead to hazardous situations and
the development of remedial actions to be taken to
reduce or eliminate such hazards.

EP 95
-
0320

4.2

Evaluate Risks

Once hazards and threats have been identified, their causes, consequences and probability can be
estimated and the risk determined. Risk assessment may be on a qualitative or quantitative basis both
involving the same steps. Qualitative
methods may be adequate for risk assessments of simple
facilities or operations where the exposure of the workforce, public, environment or the asset is low.
Inherent in many of the techniques mentioned in 4.1 is a subjective evaluation of risk. HAZOP and
FIREPRAN, for example require the team to select the critical items for further study. To do this
there must be a risk assessment which is based primarily on experience or judgement. The qualitative
or banded assessment of probability and consequence from
such an analysis can be plotted on the
Risk Matrix described in EP 95
-
0100 HSE Management System and repeated in 4.2.4. In
FIREPRAN, HAZOP and Health Risk Assessment, this Risk Matrix is used to assist in decisions
regarding risk. In the context of this ma
nual evaluate and assess have the same meaning. The THESIS
HSE Manual

EP 95
-
0300 Overview Hazards and Effects Management Process

20

EP 95
-
0300 Revision 0: 16 October 1995

software can also be used to assist in the hazard/risk evaluation and also uses the Risk Matrix.
Guidance on when to use quantitative risk assessment is provided in the following paragraphs.

4.2.1

Scenario development (causes)

The first step in the risk evaluation is to examine the ways in which events may take place to cause a
hazardous event. Causation scenarios may be developed in simple narrati
ve or use multiple branch
fault trees or utilise complex computerised modelling techniques. The method is entirely dependent
on the area being assessed. For further details on scenario development refer to
EP 95
-
0352

QRA.

4.2.2

Probability

The probability of a hazardous event occurring may be determined by evaluation of the associated
possible threats and circumstances or from historical data bases. Once esta
blished, the probability of
occurrence of each event can be included in a fault tree.

Historical records such as those described in EP 92
-
1020 (Ref.
6
) provide failure data for various
types of event in the fault tree and event tree includ
ing the Top Event. Alternatively, probability can
be generated in a qualitative way by the relative classification of probability into those shown on the
Risk Matrix in 4.2.4.

It is planned to replace EP 92
-
1020 (Ref.
6
) with a data base
prepared on an industry wide basis. This
development is underway with the E&P Forum.

4.2.3

Consequence analysis

Consequence analysis can be applied to assess HSE aspects for a range of consequence scenarios and
i
nvolves the use of predictive models. Consequence scenarios may be developed in simple narrative
or use multiple branch event trees or utilise complex computerised modelling techniques.

Examples include the use of physical effects models for assessing the
integrity of structures, for
predicting the behaviour of emissions to the atmosphere and discharge to water and predicting heat
loading and explosion overpressure. Models should only be used when they are validated in a
particular application and their pre
dictive capability is generally accepted. Successful application
requires that they be used by personnel with adequate training and experience. The results from
Physical Effects Modelling usually provide input to other HSE analyses such as ESSA, FEA and
La
yout Studies.

In performing consequence analyses it should be recognised that the majority of models provide only
a good approximation of what might happen. It is a mistake to base design calculations wholly on
model results. The designed system should be
capable of withstanding the range of possible
anticipated loadings.

Table 4.3

Techniques for consequence analysis

Technique


Reference

Physical Effects Modelling

This encompasses a number of techniques
available for modelling the effects of hazardous
releases such as explosions, gas dispersion and
fire

EP 95
-
0314

Layout Methodology

Offshore Layout Methodology

A simplified design tool for identifying separation
requirements when laying o
ut an offshore
complex


EP 91
-
1600/1601
(Refs.
7

and
8
)

EP 90
-
2500

(Ref.
9
)

4 Structured Review Techniques

EP 95
-
0300 Revision 0: 16
October 1995

21


Onshore Layout Methodology as above for
onshore facilities

DEP to be
prepared

(Ref.
10
)

FEA

Fire and Explosion Analysis is a collective term
for the process which identifies and evaluates all
fire and explosion hazardous events as a basis for
risk reduction and for preparing performance
criteria for essential safety systems and the
arrangements r
equired for escape, evacuation and
rescue (EER).

No reference

ESSA

Emergency System Survivability Analysis. This is
part of the FEA and determines the ability of the
emergency systems to withstand severe accident
conditions. ESSA is part of the FEA proce
ss and
provides information which is subsequently used
in TR/EERA.

EXPRO Docs

(Ref. 11)

TR/EERA

Temporary Refuge Escape, Evacuation and
Rescue Analysis of escape to Temporary Refuge
(TR), the provisions within the TR system, and
the Evacuation, Escape an
d Rescue provisions.
The analysis considers the major scenarios
previously identified and compares these against
respective acceptance standards highlighting
critical elements and revealing any shortfalls.

DEP 37.17.10.11
(Ref.
12
)

Environmental Dispersion
Models

Used to predict the behaviour of contaminants
following discharge. Results are used to evaluate
the significance of emissions and discharges. A
wide range of models are available and vary in
complexity and sophistication
.

Monitoring air
quality

EP 95
-
0376

Monitoring water
quality

EP 95
-
0381

Table 4.3

Techniques for consequence analysis
(continued)

Technique


Reference

Oil Spill trajectory Models

Used to predict the behaviour of marine spills and
can play an important role in oil spill contingency
planning. A number of models are available.

A range of models
available. For
advice on sele
ction
and use refer to
SIEP


Risk Assessment Models for
Contaminated Soil

These have been developed to evaluate the
significance of soil contaminants to human and
environmental health. The Human Exposure to
Soil Pollutants (HESP) developed in SIPM is an
example.

Env. quality
standards for soil
and groundwater:

EP 95
-
0385

Setting Priorities
for contaminated
soil and
groundwater:


EP 95
-
0387

HSE Manual

EP 95
-
0300 Overview Hazards and Effects Management Process

22

EP 95
-
0300 Revision 0: 16 October 1995

Groundwater Models

These have been developed to predict the
behaviour of contaminants in groundwater and
focus on the movements of the contaminants.

A range of models
available. For
advice on selection
and use refer to
SIPM


These techniqu
es are summarised in Appendix IV.

4.2.4

Determination of risk

Having determined the probability of the different scenarios occurring to cause a 'hazardous event'
and having determined the consequences arising fro
m that event, it is possible to represent the risk
graphically using the Risk Matrix described in

EP

95
-
0100

HSE Management System and repeated below:

Table 4.4

Risk Matrix


The matrix
need not remain as a static display of risk and measures to be taken. Over the years
tolerance to risk will change therefore the shading in the diagram will change.

The above matrix gives an indication of risk tolerability but this should relate to the op
eration under
consideration . An example of how the matrix can be further defined for a particular operation is
included in
Appendix V
.

4.2.5

Quantitative Risk Assessment (QRA)

QRA is a potentially powerful technique which is described fully in
EP 95
-
0352
.

Appendix VI contains specific examples and guidance of when Quantitative Risk Assessment is used
to its

best advantage.

Guidelines are available for undertaking quantitative risk assessment for specific applications
including risers and pipelines.

These are:

CONSEQUENCE
INCREASING PROBABILITY
Severity
People
Assets
Environment
Reputation
A
B
C
D
E
Never
Has
Incident
Happens
Happens
heard of
occurred
has
several
several
in EP
in EP
occurred
times per
times per
industry
industry
in Opco
year in
year in
Opco
location
0
No
No
No
No
injury
damage
effect
impact
1
Slight
Slight
Slight
Slight
Manage for continuous
injury
damage
effect
impact
improvement
2
Minor
Minor
Minor
Limited
injury
damage
effect
impact
3
Major
Localised
Localised
Considerable
injury
damage
effect
impact
4
Single
Major
Major
National

Incorporate risk
fatality
damage
effect
impact

reduction measures
Intolerable
5
Multiple
Extensive
Massive
International

fatalities
damage
effect
impact
4 Structured Review Techniques

EP 95
-
0300 Revision 0: 16
October 1995

23

Table 4.5

QRA techniques for specific applications

Technique



Reference

ASPIN

Pipeline failure ris
k analysis technique and
data base.

An easy to use quantitative failure risk
assessment tool to compare different
options and conditions during pipeline
design and operation and to assist in
optimising and planning inspection and
maintenance efforts.

Simpl
ified version.

EP 94
-
0101
(Ref.
13
)

EP 94
-
0102
(Ref.
14
)


EP 94
-
0195
(Ref.
15
)

HSE Manual

EP 95
-
0300 Overview Hazards and Effects Management Process

24

EP 95
-
0300 Revision 0: 16 October 1995

RISER

Risk Evaluation of Risers.

EP 90
-
1045
(Ref.
16
)


Assessment of risks of pipeline

riser on or
near platforms with comparative risk
analysis to assess the benefits of subsea
valve installation on pipelines.



These quantitative risk assessments should only be used by personnel with adequate training and
experience. It is most important

that those familiar with the operation, the facility or the design are
involved in the study particularly with respect to the input, assumptions and conclusions drawn to
ensure that the model reflects reality.

Assumptions must reflect actual practice incl
uding inspection and maintenance frequencies and
techniques, frequency of drills and operating procedures, etc.

QRA provides a structured approach to assessing risk and expresses this numerically. The main
function of QRA is to identify high risk areas and

assist in the comparison of design options and the
selection of operations philosophies with a view to establishing effective and efficient risk
management.

QRA assists in the determination of 'how safe is safe enough' by helping to analyse options to
est
ablish whether or not ALARP (As Low As Reasonably Practicable) has been achieved.

Engineers and decision makers sometimes like to use quantitative risk assessment to make a decision
for them. For this purpose they would like to see well defined acceptance
criteria for risk and a
calculation resulting in one number to tell them whether their design is 'right' or 'wrong'. However,
risk figures which are based on probabilities should be used with caution and comparison against
absolute numerical risk criteria
avoided where possible. This is important for a number of reasons.

First
, the accuracy of QRA studies means that the comparison of calculated numbers with specified
numerical criteria must be used with considerable caution. The inaccuracies are less import
ant in
comparisons between various options analysed in a consistent manner. Nevertheless absolute risk
figures may be required to fulfil legislative requirements and to ascertain whether ALARP risk levels
have been reached.

Secondly
, the risk of EP operati
ons calculated in a QRA is often in the 'Too High' area and nowhere
near the ‘Negligible’ area. This means that regardless of acceptance criteria set by authorities or
others, there is a need to identify further improvements and to implement them if the co
st, time and
effort can be justified.

Thirdly
, there is always the temptation to use comparison with absolute risk criteria as a means to
justify not carrying out risk reduction measures, with data being manipulated solely to meet the
criteria. Playing the

'numbers game' in this way could lead to QRA being used to justify risk levels
that could realistically still be reduced.

Fourthly
, using statistical likelihood values carries with them a set of inherent assumptions which
may or may not be appropriate for

the operation being studied.

Expressions like 'acceptably safe' or 'an acceptable risk' should be avoided when discussing risk.
Risks are never acceptable when the benefits of an activity are perceived to be smaller than the risks.
Further, a risk is neve
r considered acceptable while there are effective alternatives to lower it. If there
4 Structured Review Techniques

EP 95
-
0300 Revision 0: 16
October 1995

25

are no effective alternatives or the cost of further reduction is disproportionate then it may be
necessary to live with or 'tolerate' the risk.

QRA can be used to assess
risk to the company's workforce, assets and environment as well as risk to
the public. At present, QRA or environmental QRA is confined to 'incidental' or 'acute' hazardous
events. In EP operations, the facilities are in many cases sufficiently remote that

considerations of this
type of risk to the public do not dominate. In downstream activities, risk to the public is often the
main concern.

The application of QRA is not necessarily limited to large, complex and expensive studies. It is a
technique which c
an be used relatively quickly and cheaply to help to structure the solution to
problems for which the solution is not intuitively obvious. Without the quantification of risk in some
situations, there may a danger of allocating scarce resources for little b
enefit. Risk is often defined as
a function of the chance that a specified undesired event will occur and the severity of the
consequences of the event. For QRA purposes, chance can be expressed as frequency or probability
of an occurrence. If no attemp
t is made to estimate the chance, we may be driven by the consequence
into investing heavily on risk reduction measures which are ineffective. This is illustrated in
Figure

4.1. The risk curve (shaded) indicates the area in which effective risk reduction

measures can
be taken.

Figure 4.1

Determination of risk


On the left side of the curve the consequences are too small to cause concern, regardless of the
probability. On the right side the consequences could be dramatic but the probability is so low that

it
would be more effective to invest in those risk reduction measures which concentrate on the events
contributing to the peak of the risk curve. The above can be easily aligned with the Risk Matrix.

It must be recognised that the public and regulatory au
thorities are most interested in high
consequence events. In the context of the Risk Matrix this might be in the 'never heard of incident in
EP industry' column but nevertheless risk reduction measures must still be considered.

HSE Manual

EP 95
-
0300 Overview Hazards and Effects Management Process

26

EP 95
-
0300 Revision 0: 16 October 1995

4.2.6

Screening criteria: li
mits/standards

EP 95
-
0100

HSE Management Systems Chapter 4 describes the concept of screening risk against
criteria set in a quali
tative and quantitative manner together with the use of the ALARP principle,
which sets the risk level as low as reasonably practicable.

Guidelines which provide environmental limits and standards include:

EP 95
-
0375

Environmental quality standards
-

air

EP 95
-
0380

Environmental quality standards
-

water

EP 95
-
0385

Environmental quality standards
-

soil and groundwater

References to occupational exposure limits and standards are listed in Health Risk Assessment
(Ref.

2
) and Ionising Radiation Safety Guide (
Ref.
17
).

4.3

Record Hazards and Effects

4.3.1

Records

The documentation relating to the hazards and effects analysis and the management of hazards and
effects is included in Parts 3 and 5 of the HSE MS and HSE Case described in
EP 95
-
0310
.

In a

major project or facility the studies carried out as part of the HEMP are recorded formally usually
via the first draft of the Hazards and Effects Register. The level of detail addressed increases as
familiarity with the project or facility improves. Diff
erent techniques are then applied to identify and
assess hazards. The hazards and control measures identified during the design phase are recorded for
later transfer to the operator of the facility who will be responsible for the HSE Case. A PC based tool
developed to do this is THESIS described in
EP 95
-
0323
.

4.3.2

Hazards and effects register

The hazards and effects information gained from
the application of HEMP tools and techniques is
incorporated in the HSE Case in what is called a Hazards and Effects Register.

The HSE Case has to demonstrate that:



all hazards, effects and threats have been identified



the likelihood and consequences o
f a hazardous event have been assessed



that controls to manage potential causes (threat barriers) are in place



that recovery preparedness measures to mitigate potential consequences have been taken.

Assembly of the Hazards and Effects Register, which f
orms part of the HSE Case, begins at the
design and development stage of a project when hazards and effects from this phase are incorporated.
Hazards applicable during the construction and commissioning phase may be included or listed
separately. Later, ha
zards encountered in the operations and maintenance phase are included. The
Hazards and Effects Register is a live document and is passed from phase to phase of a development
through to abandonment. When the design phase is complete, the Hazards and Effect
s Register is
handed over to and subsequently maintained by, the operations management of a facility. The
Hazards and Effects Register will subsequently be used in the planning of abandonment and held on
record for a period thereafter.

4 Structured Review Techniques

EP 95
-
0300 Revision 0: 16
October 1995

27

4.3.3

Manual of Perm
itted Operations (MOPO)

Once the Hazards and Effects Register is completed it is possible to complete a Manual of Permitted
Operations which defines:



t桥hl敶敬⁡ 搠湵d扥b
潦 扡brier猠i湳talle搠dnitially⁡湤 t桥⁲e捯c敲y⁰ 数er敤湥ns m敡獵s敳 t漠扥oi渠
灬慣e



the limit of safe operation if the barriers and/or recovery preparedness measures (sometimes
referred to as the 'Integrity Envelope') are reduced, removed or purposely
defeated



the limit of safe operation permitted during periods of escalated risk, in either likelihood or
consequence. This includes external factors like extreme weather conditions



which activities may or may not be carried out concurrently, e.g. simul
taneous welding and crude
sampling.

Further details on the preparation of a MOPO are given in
EP 95
-
0310

Implementing and
Documenting on HSE MS and HSE Case.

4.4

Compare with Objectives and
Performance Criteria

The objectives and performance criteria adopted at all levels in the process should comply with those
stated in the Corporate HSE Policy, HSE MS and HSE Case, respect
ively (see
EP 95
-
0100

HSE
Management Systems Chapter 4).

4.5

Establish Risk Reduction Measures

4.5.1

General

Risk reduction measures include preventative measures (likelihood reducing) and mitigatory
measures (consequence reducing). As described in
EP 95
-
0100
, the point at which measures may be
classified as prevention, mitigation or recovery can sometimes become unclear depending on the
perspective of what constitutes the hazardous event. Fortunately, in practice, this makes little or no
difference to the process of risk reduction.

Control and
recovery aspects form a significant part of design standards. These are not listed
separately in this document.

A number of reference documents describing the controls are frequently used in applying the HEMP.
These are summarised below together with refer
ences for full descriptions.

4.5.2

Control of release of hazards and effects

Some typical control measures are described in the following guidelines:

EP HSE Manual:

EP 95
-
0376

Monitoring Air Quality

EP 95
-
0381

Monitoring Water Quality

EP 95
-
0386

Monitoring Soil and Groundwater Quality

EP 95
-
0390

Waste Management Guidelines

EP 95
-
0391

Classifying Waste

HSE Manual

EP 95
-
0300 Overview Hazards and Effects Management Process

28

EP 95
-
0300 Revision 0: 16 October 1995

EP 95
-
0270

General Workplace Practices

EP 95
-
0315

Guidelines on Permit to Work (PTW) Systems

EP 95
-
0317

Hydrogen Sulphide (H
2
S) in Operations

All SHC and SHSEC

guidelines e.g. Noise Guide, Asbestos, Ionising Radiation, Heat
and Cold Stress

DEPs

Refer to Index DEP Publications a
nd Standard Specifications DEP
00.00.05.05 Gen. (Ref.
18
)

Codes and standards


4.5.3

Recovery preparedness measures

Recovery from the consequences of the release of a hazard
requires careful planning. Even with a
comprehensive range of controls in place to prevent the release of hazards or effects things can still
go wrong. It is important that all personnel involved are fully briefed and drilled as to the response
measures pl
anned which may include evacuation and restoration procedures.

Recovery Preparedness Measures include active, passive and operational (contingency plans)
response arrangements.

In a crude oil separation module a loss of containment will probably be
controlled by ESD,
depressurisation and containment/fire protection devices. These control and recovery measures have
been installed to achieve the HSE objectives that have been set. They might reduce a worst case
occurrence to a single major injury or fat
ality as compared with the possible catastrophe that could
have occurred with no controls at all in place.

From an environmental perspective recovery includes site clean up and rehabilitation. An example in
occupational health would be the redeployment of
a radiographer who has exceeded his radiation
exposure or a cargo handler who has a back injury.

Documents which will assist in the development of recovery procedures include amongst others:

EP 95
-
0316

Emergency Response

DEP 37.17.10.11
-
Gen

Design of Offshore Temporary Refuges (Ref.
12
)

EP 95
-
0397

Oil Spill Dispersants

EP 95
-
0387

Contaminated Soil and Groundwater

EP 95
-
0351

Fire Control and Recovery

SHSEC 1994

Medical Emergency Guidelines for Management (Ref.
19
)

HSE 94023 Jan 1995

Medical Emergency Guidelines for Health Care Professionals and
First Aiders (Ref.
20
)

HSE 94023a Jan 1995

Guidance to First Aiders (Ref.
21
)

E&P Forum

Standards for Clinical Services (Ref.
22
)

DEPs

For index refer to Index DEP Publications and Standard
Specifications DEP 00.00.05.05
-
Gen. (Ref.
18
)

Codes and standards


4 Structured Review Techniques

EP 95
-
0300 Revision 0: 16
October 1995

29

This page intentionally left
blank

HSE Manual

EP 95
-
0300 Overview Hazards and Effects Management Process

30

EP 95
-
0300 Revision 0: 16 October 1995

APPENDIX I

ACTIVITIES: PLANNING

AND REVIEW

HEMP TOOLS AND TECHN
IQUES

In the EP Business Model (EPBM) Version 3 (Ref.
23
) the activity grouping (ACT) 'Managing
Activities' applies equally to all activities including those shown below against the life cycle.

In the 'Establishment of Business Controls' (ACT
-
01
-
06), the controls to manage HSE risk are
addressed in an HSE Cas
e. The broad HSE objectives to be met in the activities: establishment of
business controls (ACT
-
01
-
06), 'planning' (ACT
-
01
-
08) and 'monitoring/control during execution'
(ACT
-
03
-
02) are bulletised on the left of the table below. Some of the tools and techn
iques available
are listed on the right.


explore
develop
appraise
produce and
maintain
abandon
Execute Surveys
Drilling
Appraisal and
Development
Drilling
Design
Construction

Logistics
Production and
Maintenance
Decommissioning
Commissioning
HAZARDS AND
EFFECTS REGISTER
HSE CASE FOR ACTIVITY



objectives
MANAGE ACTIVITIES (ACT)
Includes: HSE Case for Specific Activities
Establish Business Controls (ACT-01-06)
eg Prepare HSE Case for specific activities such as: survey, drilling, operations, logistics

demonstrate that risks
associated with the activity
are managed
HAZID
Generic HSE Cases (under development)
Environmental Assessment
Job Hazard Analysis
Permit-to-Work
H
2
S
Fire Control and Recovery
Safe Handling of Chemicals (SDS)
Human Factors
Emergency Response (including oil spill plans),
Oil Spill Dispersants
Contaminated Soil and Groundwater
Classification of Waste
Waste Management
Prepare Plan (ACT-01-08)
eg. Prepare Execution Plan

ensure contracting strategy
reflects known risks
HAZID
Monitor and Control Activity Execution (ACT-03-02)

identify and manage any
additional hazards and threats
Tripod - DELTA
Tripod - BETA
Job Hazard Analysis
Environmental Monitoring/Standards
Health Risk Assessment
Appendix II Assets : Planning and Review HEMP Tools and Techniques

EP 95
-
0300 Revision 0: 16
October 1995

31

APPENDIX II

ASSETS: PLANNING AND

REVIEW

HEMP TOOLS AND TECHN
IQUES

The activities (Ref.
23
) described in this appendix encompass the life cycle of an asset. The HSE Case
which is prepared during the execution of these activities becomes the HSE Case for the asset and
forms part of the Asset Reference
Plan.

The broad HSE objectives are bulletised on the left of the table. Some of the tools and techniques
available are listed on the right.


HAZARDS AND
EFFECTS REGISTER

HSE CASE FOR ASSET



objectives
ACQUIRE OR DIVEST ASSET (A16)
Evaluate/Value Asset or Divestment (A16-01-02)

identify major hazards

identify environmental
effects and sensitivities
together with history of past
practices
HAZID
Environmental Assessment (preliminary)

EVOLVE DEVELOPMENT CONCEPTS (A11)
Make Facility Design Concepts (A11-04-02)

identify major project
hazards
HAZID
Carry out HSE Analysis (A11-04-05)

obtain assurance of
manageability
Qualitative comparison of risk based on judgement or coarse
QRA if significant global risks or high level of innovation
Environmental Assessment, Health Risk Assessment
Evaluate Concepts (A11-05)

obtain an assessment and
comparison of HSE risks
between options
QRA (Comparative or coarse)
Environmental Assessment (update)
Propose Development Concepts (A11-06)

finalise option selection with
due regard for HSE
review hazards within option

obtain agreement for
philosophies of:
QRA (comparative or coarse)
Environmental Assessment (update)
HAZID
Operations and Maintenance;
Fire and Explosion

DESIGN, CONSTRUCT, MODIFY OR ABANDON FACILITIES (A12)
Prepare Conceptual Design (A12-01)
(‘Validate 'Basis for Design')

ensure technical integrity of
basic process

develop layout to minimise
consequences in developing
the 'Project Specification'

review technical integrity of
detailed process

minimise risk of escalation
-for offshore and complex plant
-for less complex and onshore

ensure adequate provision
for escape

review overall risks

minimise construction risks

incorporate HSE-specific
requirements
HAZOP (coarse)
Coarse Layout Methodology
Human Factors
HAZOP (detailed)
Detailed Layout Methodology, Fire and Explosion Analysis
Emergency System Survivability Analysis
FIREPRAN
Escape, Evacuation and Rescue Analysis (use judgement
for less complex plant)
QRA (as necessary)
HAZID
Health Risk Assessment, Human Factors,
Environmental Assessment
Instrumented Protection Function (IPF) classification
HSE Manual

EP 95
-
0300 Overview Hazards and Effects Management Process

32

EP 95
-
0300 Revision 0: 16 October 1995

HAZARDS AND
EFFECTS REGISTER


objectives

DESIGN, CONSTRUCT, MODIFY OR ABANDON FACILITIES (A12) cont'd)
Prepare Detailed Design (A12-02)

ensure change does not
impair technical integrity

prepare input for HSE Case
for facility
QRA
HAZOP
see ACT-01-06
Construct and Precommission Facility (A12-03)

ensure HSE risk managed in
construction
Prepare activity HSE Case Plan (see ACT-01-06)
Commission Facility (A12-04)

verify readiness to startup
Pre-startup audit
Abandon Facility (A12-05)

ensure legal and social
obligations met with respect
to environment

decommission and remove
safely with due care for
health and environment
Prepare plan (ACT-01-06)
HAZID
Environmental Assessment (including review of past
practices and liabilities), Health Risk Assessment
HAZID
Environmental Assessment
Health Risk Assessment

DESIGN, CONSTRUCT, MODIFY OR ABANDON WELLS (A09)
(as for A12 for Wells)

(see under HSE Case for Asset)

MANAGE ASSETS (ASS)
(Includes HSE Case for Asset)
Asset Reference Plan (ASS-01-02)

demonstrate that risks
associated with asset and its
operation are managed
HAZID
Health Risk Assessment
Environmental Assessment
Job Hazard Analysis
Permit-to-Work
H
2
S
Fire Control and Recovery
Safe Handling of Chemicals (SDS)
Human Factors
Emergency Response (including oil spill plans)
Oil Spill Dispersants
Contaminated Soil and Groundwater
Classification of Waste
Waste Management
Appraise Asset Integrity (ASS-04-02)
confirm process integrity and
containment


compare fire and explosion
provisions against objectives set
Process Hazard Review
HAZOP
FIREPRAN
OPERATE AND MAINTAIN FACILITIES AND WELLS (A71/A72)

HSE CASE FOR ASSET
Instrumented Protection Function (IPF) classification
Instrumented Protection Function (IPF) classification
Appendix III
Hazards and Effects Hierarchy

EP 95
-
0300 Revision 0: 16
October 1995

33

This page intentionally left blank



HSE Manual

EP 95
-
0300 Overview Hazards and Effects Management Process

34

EP 95
-
0300 Revision 0: 16 October 1995

AP
PENDIX III

HAZARDS AND EFFECTS
HIERARCHY

The Hazards and Effects Hierarchy is a structured list of HSE
-
related hazards and effects that may
occur in the EP business. It can provide a starting point in hazar
d identification (the first step of the
Hazards and Effects Management Process, HEMP). Use of the Hazards and Effects Hierarchy as a
checklist gives greater assurance that all hazards and effects have been addressed and identification
and initial assessmen
t is complete.

The Hazards and Effects Hierarchy is a structured checklist incorporated in the PC
-
based tool
THESIS (
EP 95
-
0323
). It is continually being improved with use in different opera
tions and
environments. The hierarchy in the attached Table III.1 is therefore only included as an example or
'snapshot'. For the most up
-
to
-
date version, refer to the latest version of THESIS software.

In THESIS each hazard and effect has been assigned a
number which has been consistently carried
through to the Hazards and Effects Register. The same numbering system is used here.

The Hazards and Effects Hierarchy, Table III.1, consists of main hazard groups such as H
-
01
Hydrocarbons. Under these are sub
-
gr
oupings, such as H
-
01.06 Hydrocarbon Gas. Some examples
are given of typical sources of these hazards or locations where they will be found.

Under the three columns 'Safety', 'Health' and 'Environment' an arbitrary coding has been given which
has been foun
d useful in grouping hazards. The reason for the Health grouping is explained below.
Any other coding or tagging can be used.

No attempt has been made to link the listing of hazards with, for example business activities or types
of facilities, since any on
e hazard can invariably be present in many situations. The Hazards and
Effects Hierarchy nevertheless lends itself to use as part of a systematised approach to hazard
management.

III.1

Routine Health Hazards and Effects

Health hazards encountered in the wo
rk place and by the public are usually divided into the following
five broad groups:



捨cmi捡l⁨慺慲摳



灨p獩捡l⁨慺慲d猠su捨⁡猠湯i獥Ⱐ,ibr慴i潮o⁩潮isi湧⁲慤i慴i潮



扩潬潧i捡l 桡h慲d
猠s畣栠慳 mi捲o
-
潲g慮a獭s



敲g潮潭i挠桡z慲摳d獵s栠慳 m慮畡l⁨慮 li湧



灳p捨潬潧i捡l⁨慺慲摳⁳畣u⁡ ⁳tre獳



lif攠etyl攠eu捨⁡猠s畢獴a湣n 慢畳e



livi湧⁥湶ir潮oe
湴⁳ 捨⁡猠m慬慲i愠慮搠a湶ir潮o敮e慬 灯pl畴i潮

T桥⁈慺慲摳d慮搠affe捴s⁈i敲ar捨c⁡ ⁰r敳敮e敤⁩渠nhi猠慰灥湤i砠慮⁢a 獯st敤⁴漠c潶敲⁡ l⁳ g湩fi捡nt
桥hlt栠h慺慲摳d慮搠aff散t猠s渠n桩猠sr摥d 慮a 桥r 摥d t桡t⁩s⁲e煵qr敤e

III.2

Environmental Hazards
and Effects

Effects on the environment may be due to unintentional incidents (e.g. a fire or chemical spill) or due
to intended often continuous, routine or chronic releases as part of the operation.

Appendix III
Hazards and Effects Hierarchy

EP 95
-
0300 Revision 0: 16
October 1995

35

The Hazards and Effects Hierarchy listing, Table III.1,
is valid for both
incidental

releases and
routine

releases. As described in 2.1, a
hazardous event

in the case of the
routine

or
chronic

release
is when defined limits have been exceeded. A
hazardous event

in the case of an
acute

or
incidental

release is an occurrence or incident.

Limits should be defined for routine releases which have an adverse effect on the environment.

Reviewers often find it easier to think in terms of sources of environmental effects. To assist in this
identification Tab
le III.1 is a checklist of sources, of environmental hazards and of potential effects.
This table can assist in the identification of hazards and effects when reviewing a proposed
development or operation (i.e. in the Environmental Assessment process) or w
hen reviewing effects
from the existing operation and preparing reduction plans.

The list is not complete and any further additions to the checklist should be forwarded to SIEP.

Currently, three types of environmental hazards have been identified:



桡h慲摳⁡獳o捩at敤⁷it栠摩s捨crg敳r⁥ i獳i潮o



桡h慲摳/敦f散t猠fr潭⁵獥 湡nur慬⁲e獯畲捥s



桡h慲摳⁣慵ai湧⁥ f散t猠srom⁰ 敳敮e攮

It⁩猠湯s⁡lw慹猠灯ssibl攠t漠灩湰ni湴 愠a敮畩n攠桡z慲d⁣
慵ai湧⁴h攠effe捴Ⱐ攮e⸠.敳our捥⁵獥⁣慮⁲敳ult
fr潭⁡畭扥b ⁡捴iviti敳.

Key to Hazards

Table III.1

The Hazards and Effects Hierarchy

Safety Hazards

Health Hazards

Environmental Hazards

F = Flammable

B = Biological Agent

D= Discharge Hazards

MH =
Major Hazard

C = Chemical Agent

R = Use of Natural Resources

Se = Security Hazard

E = Ergonomic Agent

P
r

= Presence

WP = Work Practice

P = Physical Agent