Identify Recover HEMP Assess Control HEMP and ALARP

Identify Recover HEMP Assess Control HEMP and ALARP Training ALARP 1

Objectives of HEMP & ALARP Training • Increase Awareness of HEMP Concepts • Develop a common understanding of ALARP Principles These topics are covered in more detail in: HSE 0026 – Hazards and Effects Management Process (HEMP and ALARP) 2

Hazards and Effects Management Process (HEMP) 3

HSE Management System 4

Individual HEMP Responsibilities Responsible and accountable for conducting their work in such a manner which reduces to ALARP or eliminates risk to All Employees their own personal health and safety and that of their fellow employees and that ensures the protection of the environment, company assets, and company reputation. Participate in HEMP efforts for your Area, including asset integrity Technical Staff Achieve a competent level of understanding concerning your Area’s HSE Case and Activity Specification Sheets Comply with strict adherence to the organization’s MOC policy 5

Hazards and Effects Management Process 6

Risk Assessment Matrix & Major Hazards A 5 B 5 Major Hazards are those that have high risk or high potential consequences 7

Major Hazards & HSE Cases SEPCo Policies require that operations and facilities with Major Hazards have documented HSE Cases. An HSE Case is a facility or operation-specific demonstration that the HSE risks from Major Hazards are managed to As Low as Reasonably Practicable (ALARP) and a description of how SEPCO’s HSE Management System is applied to HSE hazards. 8

Bow Tie Terminology Term Definition Top Event the loss of control or release of the hazard. Threats “release mechanisms” of the hazard. Barriers • prevent the release of a hazard (i. e. top event) and act directly on the threat • are the hardware and procedures in place to prevent the threat from leading to the top event. • appear on the left hand side of the bow-tie. Consequences • the effects of a hazard once it has been released. • appear on the right hand side of the bow-tie. Recovery Measures • mitigate a hazard’s potential to cause harm, damage, and environmental impacts. • are similar to barriers, but act on the consequences • appear on the right hand side of the bow-tie. 9

Bow-Tie Example Consequence 3 Loss of Containment Threat 2 Threat: Corrosion ESCALATION FACTOR Change in operating environment MOC Process Inspection Program ESCALATION FACTOR CONTROLS BARRIER RECOVERY MEASURE Consequence 2 Ignition Source Control Corrosion Management Process H- 01. 06 Hydrocarbon Gas Threat 3 Consequence: Explosion ESCALATION FACTOR Field Inspection Temporary Equipment Standard Installation of Temporary Equipment ESCALATION FACTOR CONTROLS 10

Best Practice Bow Ties There will be a single bow tie for each major hazard in SEPCo that sets the minimum required barriers/recovery measures to manage risks. These are Best Practice Bow Ties. Each Asset or Operation will: • review applicable best practice bow ties to consider and document any unique threats/consequences that may exist at their location. • benchmark the effectiveness of the barriers at their location against the performance expectation included in the best practice bow ties. • Identify gaps and implement remedial actions to improve the barriers / recovery measures and reduce the risk to ALARP. 11

Hazard Register The Hazard Register describes hazards, their associated risks, and how the hazards are managed. Those items with in the Health column were identified during health risk assessments, and consider chronic and Those items with an Environment rating are E-aspects. Those that are Major in the Environment column are acute health exposures “Significant E-aspects” Hazard Description Potential Consequences Sources of expsoure Health People - Safety Assets Environ ment Reputati on Overall Risk Controls H-01. 01 Crude oil under pressure unignited release fire spill / environmental impact personnel injuries/fatalities loss of asset / asset damage production loss for health effects of flammable hydrocarbons, see the listings under H -21/22 General Chemicals Mmajor H Mmajor M H For locations where this is a major hazard, see the HSE Case. For other locations, see Table 5. 1 in SEPCo HSE MS Part 5. H-19. 07 A Carbon monoxide (Gas) Acute: chemical Power generation asphyxiant causing unit; engine carboxyhaemoglobin exhausts, Chronic: Category 1 emergency Teratogen, may generators, boilers, cause harm to fired equipment unborn child, unconsciousness, fatality M L N N N M 1. CO monitor in temporary quarters where combustion emission may occur. H-20. 01 H 2 S (hydrogen sulphide, sour gas) personnel injury / Raw Material. Sour fatality crude. minor environmental impact Examples include Health: rich and fat DEA, Acute: Irritant to sour water, fuel gas eyes, skin and streams, sour respiratory tract. hydrogen, acid gas, Chemical asphyxiant spent caustic causing respiratory stripper overhead paralysis, irritant; unconsciousness, fatality Chronic: prolonged contact may lead to dermatitis Mmajor M L N M Mmajor For locations where this is a major hazard, see the HSE Case. For other locations, see Table 5. 1 in SEPCo HSE MS Part 5. For Health, Refer to generic Chemical Minimum Controls in Table 5. 1 of SEPCo HSE MS Part 5. 1. MMS Contingency Plan for Outer Continental Shelf (OCS) 2. Local Emergency Response Plan 12

HEMP Tools The most commonly used HEMP tools are highlighted 13

Risk Management Hierarchy In order of preference: 1) Eliminate – remove the risk altogether 2) Substitute – use a lower risk alternative 3) Isolate / Separate – keep the hazard away from where it can cause harm 4) Engineering Controls – Prevention – design such that the risk of an incident is minimal 5) Engineering Controls – Mitigation – design such that if an incident occurs, it is mitigated 6) Procedural Controls – provide procedures to reduce risk 7) Personnel Protective Equipment – provide protection to reduce potential for injury Identify Recover HEMP Assess Control 14

HEMP Study Interactions Audits Incident Investigation Procedures Variances Project HSE Plan HEMP Study Regulations HSE Case Designs MOC Process 15

Asset Responsibilities for HEMP Studies • The owner of the HEMP study is the accountable party for the asset or operation covered by the study. The owner is accountable for: – Maintaining the study – Updating the study at the requisite frequency – Making sure actions from the study are documented and closed • Studies done for design considerations are kept by engineering. • Studies done for operational considerations are kept by Operations. • Action items resulting from SEPCo HEMP studies shall be tracked and closed out using IMPACT. 16

Human Factors Engineering The Group Minimum Health Management Standard states: Human factors engineering principles are to be considered and applied during the early design stage of new facilities projects where design can have a critical impact on equipment usability and user safety or health. The following picture illustrates how a human interacts with a technical component and the factors that can influence his/her performance. Work Environment Organizational Structure (lighting, noise, chemical exposures, climate) (job design, communication, task) Individual Constraints (age, size, training, skills, intelligence) Sensory Information Action Human TASK Interfaces - Displays Interfaces - Controls Output Input Machine 17

As Low As Reasonably Practicable (ALARP) 18

ALARP TRIANGLE 19

Risk Perception - Types of Fatalities, US, 2001 Match the causes to the listed number of deaths/year (data from the National Safety Council). Cause Number of deaths /year Answers Accidental Drowning (Non Transport) 47, 288 Transport Accidents 20, 308 Assault Contact with venomous animals & Plants 15, 019 Falls Lightning 14, 078 Accidental Poisoning Legal Intervention 3, 309 Exposure to smoke, fire and flames Falls 3, 281 Accidental Drowning (Non Transport) Assault 396 Legal Intervention Accidental Poisoning 61 Contact with Venomous animals & plants Exposure to smoke, fire and flames 44 Lightning 20

Relative Risk Increasing Individual Risks and Societal Concerns Tolerability Threshold Oil and Gas Extraction Transport Accidents Assault Falls Accidental Poisoning Drowning Legal Intervention Venomous animals & plants Lightning 21

Actual Vs Perceived Risks Which “hazard” results in more deaths per year? 45 Deaths in 1996 59 Deaths in 1995 76 Attacks Worldwide 49 Attacks USA 1 Death USA 2001 22

Risk Misperception . . Mountaineering Council for Scotland said “These two men were very aware of safety issues and did not have a reputation for taking any sort of risks” 23

Problem Framing An outbreak of disease is expected to kill 600 people. Two alternative programs have been proposed: Which program would you select? 24

Rephrasing the Problem Depending on the problem phrasing, people made different decisions: 25

ALARP Definition To reduce a risk to a level that is as low as reasonably practicable involves balancing reduction in risk against time, trouble, difficulty and cost of achieving it. This level represents the point, at which time, trouble, difficulty and cost of further reduction measures become unreasonably disproportionate to the additional risk reduction obtained. Screening Criteria • From quantitative risk analysis Risk • • • ALARP ? Cost 26

ALARP: Road Transport Example When does the cost of further reduction measures become disproportionate to the additional risk reduction obtained? : • • • • No specification Does not meet legal requirements No regular vehicle maintenance Provide recovery measures, e. g. roll-bars, seat belts Provide mitigation, e. g. , speed limiter, 4 WD Provide driver training Provide safe driving incentives Journey management system Road transport management system Avoid journeys by planning Build black-top roads Use aircraft transport only Automate production facilities - eliminate routine driving Stop production Intolerable SCREENING CRITERIA ALARP region ALARP probably in this area 27

ALARP and Risk Tolerability – 4 Levels of Risk The HEMP Standard describes the Tolerability Threshold, Evaluation requirements and Demonstration requirements for each of these levels of risk. 28

ALARP and Risk Tolerability Decision-Making ALARP and risk tolerability decisions are required when changes affect hazard management. For example: • Variances to SEPCo requirements • Identification of a new hazard, or a change in risk of an existing hazard • Operating without barriers/recovery measures or operating in a way that deteriorates a barrier • Making a change that impacts an existing barrier • Selecting a new concept • Adding additional risk such that the cumulative risk threshold may be approached 29

Decision Making Framework Outline Means of Calibration Codes and Standards Decision Level Well understood risks Peer Review Drivers Benchmarking Very novel Internal Stakeholder Consultation Significant trade-offs External Stakeholder Consultation Values Based Strong views and perceptions Higher level of Management Verification Technology Based Well established solution 30

Decision Making Framework Decision Level Higher level of Management 31

Following the Decision-Making Process Define decision Determine decision type What do you need to decide? Type A? Type B? Type C? Use the right-hand side of the framework. Evaluate at the Cumulative, hazard, threat, and failure mode levels Calibrate Use the lefthand side of the framework. Demonstrate the decision as defined in the HEMP Standard 32

Type A Decision Example Define decision How to design a ladder for accessing a work platform. The decision context is Type A because this decision is well-understood. Determine The decision bases are Codes and Standards (ASME, You have to design a new ladder to access a work decision type cumulative risk level – N/A platform. SEPCo design schedules), Good Practice, and Engineering/Expert judgment of the designer. hazard level - consider whether a new hazard is being added or a change in risk is being proposed for an Evaluate existing hazard. Consider the risk management hierarchy. How are ALARP principles applied? Calibrate Demonstrate threat/consequence level - verify against the Since this decision is well understood (Type A), the personnel at heights bowtie. means of calibration is Codes and Standards, so no failure mode level – N/A additional consultation is required Since this decision is well understood (Type A) reference is made to the Hazards and Effects Register, and no additional demonstration is required other than the normal project documentation such as as-built drawings and calculations. 33

ALARP Thinking The picture shows an example of a ladder and cage. Has it been designed to reduce the risk to ALARP? 34

ALARP Thinking - Risk Reduction Ideas (RRIs) Consider the Evaluate step. Evaluate hazard level - consider whether a new hazard is being added or a change in risk is being proposed for an existing hazard. Consider the risk management hierarchy. Develop Risk Reduction Ideas for the preceding example. Remember the Risk Management Hierarchy! • • • Eliminate Substitute Isolate / Separate Engineering Controls – Prevention & Mitigation Procedural Controls Personnel Protective Equipment 35

Ranking Tool for selecting options Cost multiplier X Benefit multiplier X Effort multiplier = Score Sample Score assignments Cost multiplier Cost of Implementation 1 Low 2 Medium 3 High Cost Range Proposed Action <$50 k 1 -4 Do $50 k -$500 k 6 -9 Study >$500 k 12+ Pass Benefit multiplier Benefit Examples 1 High Move one or more boxes on risk assessment matrix. Reduction of likelihood of a magnitude or more (failure goes from 1/10 to 1/100), consequences are reduced significantly (from potential fatality to minor injury), benefit due to lower penalties/cost of absence/injuries, significant positive reputation impact 2 Medium Reduction of likelihood less than magnitude (from 1/10 to 1/50), consequences are reduced, benefit due to lower penalties/cost of absence/injuries 3 Low Effort multiplier Effort of Implementation Activities examples 1 Low Quick fix, simple to do, applicable to a specific location (no SEPCo wide impact). Little planning required, one person or small team can execute RRI. No shutdown or downtime required. 2 Medium Simple fix but with Asset or Operation-wide implications. Complex, site specific activity. Some planning required. Involvement of local contractors. Small team to carry RRI out. May extend a shutdown. 3 High Limited reduction in likelihood, limited reduction in consequence Complex activity with SEPCo wide implications. Major planning involved. May involve larger contracts. Specific SEPCo team required. Requires a dedicated shutdown to implement. 36

Selected Option 37

Type B Decision Example A pressure vessel has been noted to have a reduction in wall thickness from corrosion. Should it be kept in service? How would you make this decision? Define decision Is a pressure vessel fit for service based on changes in wall thickness from corrosion? Determine decision type The decision context is Type B since it is a deviation from codes and standards or good practice (API RP 579) Evaluate cumulative risk level – N/A hazard level – evaluate based on the vessel contents for considerations regarding environmental effects, flammability or health hazards. The risk management hierarchy should be used. threat/consequence level - An analysis should be conducted for overpressure and any other threats that might be impacted by reduced wall thickness (corrosion, vibration, etc. ). failure mode level – conduct a detailed analysis for each failure mode. Calibrate The means of calibration is peer review, so consultation is made with: • Technical Authorities • Regulatory Affairs • Workforce • Senior Leadership Demonstrate Consult the HEMP Standard for demonstration requirements! Since this is a Type B decision, demonstration shall be made using the report format in Attachment B of the HEMP Standard. Reference the hazard management hierarchy and the Engineering Analyses from Fitness for Service reviews. 38

HEMP Web Site Available via the HSE in SEPCo Web Portal or directly at http: //sepco 3. shell. com/sites/hse/hemp/ 39

Summary of HEMP & ALARP Training • You should now be aware of HEMP Concepts • We all should have a common understanding of the ALARP Principle 40