Releases (HCRs)
• Major source of HCRs: system piping (piping, flanges, valves) and instrumentation (i.e. Small Bore Tubing systems (SBT)).
• Main operating systems experiencing HCRs: gas compression.
• Biggest operational cause: wrongly fitted equipment. • Next biggest operational cause: incorrect or
improper operation (human factors).
• Main procedural cause: failure to comply with procedures (human factors).
The UK HSE figures reveal that in an eight year period from 2000/2001, instruments (SBT) were the largest single contributor to HCRs greater than 25kg. They further show that inspections and surveys on SBT systems suggest that 26% of fittings examined contained faults, e.g. under-tightness, incorrect or mismatched components, leaks, incorrect or poor installation, etc. and that this failure has been consistent since 2001.
(Source: Offshore Information Sheet No.2/2009, Hydrocarbon Releases (HCRs) Offshore, HSE, 2009 (http://www.hse.gov.uk/
offshore/infosheets/is2-2009.pdf))
What we have detailed above are the causes of hydrocarbon releases, which must be addressed by risk controls. Our “What if?” scenario needs to show, based on the size and location of the hydrocarbon release, what the potential results, in damage and injury/loss of life, could be. This potential will enable us to determine priorities around which we introduce the risk controls to prevent the hydrocarbon releases.
We start with the worst case scenario: What?
• A major HCR (e.g. above 25kg). Where?
• From piping or instrumentation. • On a gas compression unit.
• In close proximity to a welfare or accommodation facility.
• With uncontrolled ignition sources in the vicinity (e.g. electrical fault).
When?
• At a time when occupation of that facility is greatest (e.g. in a canteen at a main mealtime), e.g. 34 workers (50% of staff).
• The deluge system is on manual override due to maintenance work.
How?
• Poorly maintained piping or instrumentation with incorrect fittings and not correctly tightened. Why?
• No planned preventive maintenance or inspection programme.
• No detection equipment for hydrocarbon releases. • No emergency action plan in place for hydrocarbon
releases.
• No fire-fighting equipment in the vicinity of the release. (or fire fighting equipment empty/not maintained/moved).
• Poor fire-fighting training for personnel. • Poor response by personnel/lack of response
training.
• Lack of management leadership decisions. Hopefully this is an exaggerated circumstance, and many of the variables will already have been dealt with by the design of the installation (i.e. no welfare or accommodation near gas compressors) but the analysis can be used to give us the opportunity to examine the realisation of this type of hydrocarbon release hazard. How likely is it (what is the probability) that of all of these events (and we could possibly discover more by a greater in-depth analysis) will actually happen at the same time? Were they to happen, what would be the severity (the consequences) of the release?
Again, we start with the worst case scenario: What?
• Hydrocarbon release is ignited by electrical fault. • Explosion and fire engulf the canteen.
• All 34 workers in the canteen are lost. • Gas compression unit destroyed by blast. • Gas process operation lost – long downtime. Why?
• No warning of hydrocarbon release.
RRC
Sample
• No water from the deluge system. • Long release duration.
• Fire-fighting media not available. • All on-shift workers in other areas. • No trained response team.
• No emergency action plan or EER (Escape, Evacuation and Rescue).
• Time taken to get response teams to location too long, etc.
You need to continue this process to discover all the consequences, however minor.
As you work down the possibilities within each scenario, you begin to eliminate or reduce some of the consequences and the probability of them occurring. For instance, if there are no welfare or accommodation facilities in proximity to the gas compressors, then this leg of the trail will not be there, and we will not lose 50% of our crew. If the fire deluge system is not on manual override, water will be available to deal with a fire, etc.
Concept of Risk Control Barrier Models
As well as the risk controls we have looked at, we could also consider placing barriers between the event and its results, or placing a barrier between the hazard and its realisation.An example given by the UK HSE in the Offshore Information Sheet No 3/2006 illustrates the concept of using barriers in a bow-tie diagram which represents all of the initiators of the scenario and the consequences. Between the initiators and the consequences, barriers are placed that should prevent, control or mitigate the outcome of the event. In this case such barriers are known as Lines of Defence (LOD) or Layers of Protection (LOP).
Reference numbers can be assigned to barriers which are common to several event initiators for a particular scenario (see barrier 1a in the following diagram, which comes between two initiators and the release) as well as those common to several scenarios.
RRC
Sample
Based on Offshore Information Sheet No.3/2006, Guidance on Risk Assessment for Offshore Installations, HSE, 2006 (http://www.hse.gov.uk/offshore/ sheet32006.pdf)
Example Barriers:
• Plant layout • Construction standards • Inspection • InstrumentationExample Barriers:
• Detection system • ESD (Emergency ShutDown)
• Active protection • Passive protection
• EER (Escape, Evacuation & Rescue)