HID Inspection Guide Offshore Inspection of Maritime Integrity (Loss of Stability & Position)

Contents Summary Introduction Action Background Organisation - Targeting - Timing - Resources - Recording & Reporting Performance Assessment Further References Contacts Appendices - Appendix 1: Stability and Ballast Systems - Appendix 2: Watertight Integrity - Appendix 3: Mooring Systems - Appendix 4: Dynamic Positioning Systems - Appendix 5: FPSO Cargo Tank Operations and Offloading

Summary This guidance outlines an approach to the inspection of a dutyholder’s management arrangements for Maritime Integrity on a floating installation.

Introduction Maritime Integrity applies to all floating installations. Maritime Integrity is about staying upright and afloat, maintaining position and installation motions within operational limits; and includes safe practice in all marine operations.

Maritime Integrity has been split into 5 main topic areas as listed in the Appendices. A maritime integrity inspection should include all of the applicable appendices for a given floating installation.

An overall score for the maritime integrity inspection is assigned by following the process for ‘Performance Assessment’ described in this section.

Action The aim of this Operational Guide (OG) is to provide information and guidance to offshore inspectors to support the delivery of consistent and effective offshore

Maritime Integrity inspections. It does this by highlighting key areas essential to an effective process, so that these can be covered during inspections, providing a framework for inspectors to judge compliance, assign performance ratings, and decide what enforcement action to take should they find legislative breaches. In doing so, it complements HSE’s Enforcement Policy Statement (EPS) and Enforcement Management Model (EMM).

Success criteria (fundamental requirements) are listed under the inspection topics (see appendices); these cover the key issues that inspectors should consider when carrying-out inspections against each core intervention issue. In some instances, not all of the success criteria will apply so inspectors should make a judgement regarding which of these are relevant in each case. If the relevant success criteria cannot be met, inspectors should assess how serious the consequences of failure to comply could be. This guidance document will help in their decision making in terms of the performance ratings that they assign and the enforcement action they take (if any) based on the findings of the inspection.

Background HSE Legislation

Existing international and flag authority marine legislation, and classification society rules, regulations, and standards are useful reference material in determining the standard expected. However, these are not directly enforceable under HSE legislation. The following HSE legislation is found to be particularly relevant for inspections of maritime integrity:

DCR Reg 4 – General duty to ensure integrity of installation. DCR Reg 5 - Design of installation to withstand reasonably foreseeable forces and damage. DCR Reg 7 – Operation of installation to be within defined limits. DCR Reg 8 – Maintenance of integrity with periodic assessments and remedial work.

PFEER Reg 5 – Assessment of major accident precursors (e.g. flooding; collision) PFEER Reg 6 – Preparation for emergencies; and general marine competencies PFEER Reg 8 – Emergency response plan; including marine incidents PFEER Reg 10 – Detection of incidents (e.g. bilge alarms; tank gauges) PFEER Reg 12 - Control of emergencies, including remote operation of plant PFEER Reg 19 – Suitability and condition of plant, maintenance of marine SCE.

PUWER Reg 4 – Suitability of work equipment – includes marine equipment PUWER Reg 5 – Maintenance of work equipment PUWER Reg 7 – Specific risks – control and competency during maintenance PUWER Reg 11 – Dangerous parts of machinery – adequate protection from rotating shafts

SCR Reg 21 – Continuing effect of verification schemes

Organisation Targeting Inspectors should undertake Maritime Integrity inspections as part of the agreed ED offshore intervention plan, when intelligence indicates intervention is necessary or when investigation due to incident is required.

The inspection may be carried out at any floating installation (including jack-up units). Where maritime integrity issues are identified it is essential to ensure that duty holders are robust in their assessment of the implications for their other installations.

Timing Inspections should be planned within the timescales set out by ED divisional management.

Resources Resource for the undertaking of Maritime Integrity interventions will come from discipline specialist inspectors and Inspection Management Team inspectors as appropriate.

Recording & Reporting The operator's performance ratings should be entered on the Inspection Rating Form (IRF) tab of the relevant installation Intervention Plan Service Order. Findings should be recorded in the normal post inspection report and letter.

Performance assessment When inspecting Maritime Integrity there are two areas to be considered as follows;

a) Do the risk control measures implemented lead to compliance with the relevant legislation? This decision will be made in the same way as for other inspection topics by comparing the standard of control achieved against the relevant benchmarks and applying the principles of EMM. b) The inspection will then reach a conclusion on how well the dutyholder is managing Maritime Integrity. This should be recorded using the assessment criteria listed below.

The following descriptors will be used to assist in determining the appropriate risk gap score for the dutyholder.

a) Unacceptable (Score 60) - The management of maritime integrity is grossly deficient in a number or areas. b) Very Poor (Score 50) - A number of deficiencies in meeting minimum legal requirements for maritime integrity have been identified. The management system has failed to address these deficiencies. c) Poor (Score 40) - There is a system in place for managing maritime integrity and this is being followed. However, there are numerous examples where the system has not resulted in the implementation of effective control measures.

d) Broadly Compliant (Score 30) - There is a system in place for managing maritime integrity. It has been fully implemented; and most issues considered have resulted in appropriate control measures. e) Fully Compliant (Score 20) - There is a system that has been fully implemented and is effective in identifying appropriate control measures for all relevant aspects of maritime integrity. f) Exemplary (Score 10) - Meets the fully compliant standard but with evidence of class leading systems in complex areas such as the inspection and monitoring of difficult to access areas of mooring systems and hull structure.

EMM RISK GAP EXTREME SUBSTANTIAL MODERATE NOMINAL NONE NONE TOPIC PERFORMANCE SCORE 60 50 40 30 20 10 Broadly Fully Unacceptable Very Poor Poor Exemplary Compliant Compliant Significantly Meets most of Meets the Unacceptably below the the relevant relevant far below relevant minimum legal Exceeds the minimum legal relevant Substantially minimum legal requirements. relevant requirements. minimum legal below the requirements. minimal legal requirements. relevant Most success requirements. All success minimum legal Several criteria are fully criteria are fully Most success requirements. success criteria met. All success met. criteria are not are not fully criteria are fully met. Many success met. Degree of non- met. Management criteria are not compliance competent and Degree of non- fully met. Degree of non- minor and Management able to compliance compliance easily competent, demonstrate extreme and Degree of non- significant. remedied. enthusiastic, adequate widespread. compliance and proactive in identification of substantial. Limited Management devising and the principal Failure to recognition of recognise implementing risks, recognise Failures not the essential essential effective safety implementation issues, their recognised, with relevant relevant management of the necessary significance, limited components of components of system to ‘good control and to commitment to effective health effective health practice’ or measures, demonstrate take remedial and safety and safety above standard. confirmation that adequate action. management, management, Actively seek to these are used commitment to but demonstrate and further improve effectively; and take remedial commitment to commitment to standards. subject to action. take remedial improve review. action. standards. EMM INITIAL ENFORCEMENT EXPECTATION Prosecution / Enforcement Enforcement Letter / Verbal None. None. Enforcement Notice / Letter. Notice / Letter. warning. Notice.

The overall performance rating for marine integrity will be obtained from a combination of each of the applicable areas of maritime integrity as listed in Appendix 1 to Appendix 5.

Sample checklist examples are given in each Appendix. A number of typical opening questions, together with typical ‘good’ and ‘poor’ resultant findings from an inspection are given. The inspector will then use professional judgment to determine the overall risk ranking for maritime integrity for the installation.

Further References

Offshore Information Sheets

OIS 4/2013 Offshore installation moorings

OIS 1/2012 Effective implementation of offshore verification requirements

OIS 4/2011 Flooding risk to machinery spaces of floating offshore installations: Guidelines on inspection of ship side valves; flood detection and control; inspection and training

OIS 2/2010 Reducing the risks of hazardous accumulations of flammable/toxic gases in tanks and voids adjacent to cargo tanks on FPSO and FSU installations

OIS 8/2009 Oil mist hazards on dual fuel diesel engines

OIS 6/2007 Jack-up (self-elevating) installations: floating damage stability survivability

HSE Safety Bulletins

OSD 1-2013 Warning to offshore industry on blocking of data communications in dynamic positioning systems

HID 2-2012 Warning to offshore industry on possible failure of fire resistant composite deck gratings

OSD 5-2010 Assessment of the adequacy of venting arrangements for cargo oil tanks on FPSO and FSU installations

Contacts ED Offshore: ED4.3

Appendices

Appendix 1: Stability and Ballast Systems.

Appendix 2: Watertight Integrity.

Appendix 3: Mooring Systems.

Appendix 4: Dynamic Positioning Systems.

Appendix 5: FPSO Cargo Tank Operations and Offloading.

Appendix 1: Stability and Ballast Systems.

Load Management & Stability Control

The stability of a floating installation, whether monohull (surface units), semi submersible (column stabilised units), jack up (self elevating units) or other design is of the utmost importance. A lack of basic understanding of stability and the control of stability can and has led to major maritime disasters.

The standard of performance required by the HSE for both Intact and Damaged stability is defined in detail in RR 387. Other Codes may have been used in the installation design. These include IMO Load Line, Intact Stability, and SOLAS requirements; IMO MODU Code; MARPOL; and SPS Code. The Safety Case and Marine Operations Manual should show which code is the limiting case. This is usually expressed in terms of a ‘maximum allowable KG’, (Vertical Centre of Gravity).

The Marine Operations Manual (refer to RR 387) is a document containing information about stability, loading, and ballast systems of the installation. This will normally be approved by a Classification or Flag Authority. Where installations are not classed, it is expected that stability information is approved by a competent authority as part of the verification process. Limits to deck loading, and restrictions on tank loadings will be defined in the Operations Manual, (typically be to avoid excessive shear forces, bending moments, torsional stress, or to limit the effects of flooding).

In essence a floating vessel with good intact stability will quickly return to its upright condition after it has been heeled to one side by wind or wave action. Loss of stability of the installation is interpreted as damage to watertight hull structure, or an unplanned change in the floating stability of the installation, and is defined as a ‘major accident’ in Regulation 2 of the Offshore Installations (Safety Case) Regulations 2005 (SCR).

The stability of the installation is under the control of the Marine Supervisor, or Ballast Control Operator. Routine operations will include daily checks on load distribution, in particular the movement of deck cargo. Daily checks will be kept and recorded in the marine log.

A load or stability computer will be installed and the hull tank contents, such as ballast, fuel oil, freshwater or drill water will usually be automatically uploaded to the stability programme. Marine personnel will need to input manually changes to deck loads such as deck containers, BOP movements, drill pipe and tubulars and other variables. This system does not directly control stability, but is a tool to determine the installation stability.

The Loading computer/stability programme will also display additional information depending upon the vessel type, for example Torsional stress on a semi submersible and Bending moments and Shear forces on a ship shaped vessel.

A new installation is assigned a lightweight. Over time modifications to the structure and equipment changes will have an effect on the lightweight of the installation. Weight changes should be accurately recorded and a Record of Lightweight change kept which is scrutinised and approved by third parties. Where there is an overall change greater than 2% of lightweight, or doubt about the lightweight and centre of gravity, then this should be

recalculated, which may be by means of an inclining test or an alternative in service monitoring system.

The control of stability is Safety Critical and as such a system must be in place which will enable the stability of the installation to be calculated under all conditions, including total loss of power. This may either take the form of maintaining an additional copy of the stability software available to undertake the calculations on a laptop computer or an entirely manual system utilising a paper based system. Stability software is normally type approved by a Classification Society. Where the installation is also classed the stability results are confirmed for accuracy on the installation computer system. In any event the maritime staff must be able and competent to calculate the stability under all conditions, including total loss of power.

Ballast System

Main Ballast System

The Ballast system is safety critical and is used to control the stability, whether intact or damaged, by moving sea water to or from various locations in the structure in order to bring the vessel to a safe and level trim as well as to keep the structural loading (shear forces, bending moments, torsional stresses, etc) within permissible limits. The movement of the water to, from or between ballast tanks and the sea uses the dedicated ballast system. Ballast arrangements may be by gravity for intake from sea, and by pump for discharge overboard. The ballast system will be displayed on a mimic panel and/or a computer monitor, the tank contents, the open/closed status of all valves, pipelines and pump parameters will be clearly indicated. Manually selected switch operations will determine the movement of the ballast water to and from the ballast tanks. The operation of each switch normally energising a solenoid which will in turn direct high pressure hydraulic oil to the selected ballast valve actuator. It is normal for the ballast tank valves to fail to the closed position thus reducing the risk of ballast transfer in the event of power failure. Ballast sea chest valves are to fail closed on loss of power. Non-return valves on overboard discharges should be in the correct orientation and adequately inspected to verify their integrity.

The ballast system is controlled from more than one location, for example from either the engine control room or the pilot house/Bridge. One of the control stations shall be within the temporary refuge.The means of switching from one control station to the other must be clear and unambiguous.Where the Ballast suction comes from Main Sea water crossovers the ships side valves should have a remote direct operation which should be regularly tested.

Typically the ballast system will be used in normal operation; to move a semi submersible between transit, operational and survival drafts; to compensate for the increase or decrease in draft in a monohull FPSO as the crude oil is either loaded or discharged; and to empty or fill the pre load tanks in a jack up on arrival at a new location.

In an emergency situation the ballast system will be used to bring the vessel to a safe and level trim as soon as possible. The ballast system is also used to compensate for the loss of buoyancy brought about by damage to the installation.

Secondary or Emergency Ballast System.

In a number of semi submersible designs the pump rooms are at the aft end of the pontoons. This arrangement can lead to a situation where the ballast pumps in the aft pump rooms are unable to draw suction on the forward ballast tanks when the vessel is “down by the head”. A means of deballasting the forward tanks is therefore required and may take the form of dedicated secondary deballasting pumps, powered from the emergency switchboard, installed in the forward columns adjacent to the forward ballast tanks.

Alternative arrangements may take the form of bilge eductors drawing from the forward tanks. Pressurising the forward tanks by means of the rig air system thus creating an artificial suction head on the pumps drawing from the affected tanks is not regarded as safe practice.

Emergency Bilge Arrangements, (sometimes referred to as Bilge Injection).

In the event of flooding of a machinery space, which exceeds the capacity of the bilge pumps, the largest capacity pump in the machinery space (usually ballast or a sea-water cooling pump) must be able to draw directly from the machinery space bilges and thus extract water from the flooded spaces at an enhanced rate. The emergency bilge suction will be fitted with non-return valves to prevent the ballast system from flooding water into the bilges and should be clearly identified.

Competence

The offshore marine positions will need to be able to demonstrate their marine competence by reference to recognised and approved competence training schemes.

In 2005 the International Association of Drilling Contractors, IADC, launched an accreditation for the suppliers of marine ballast and stability training course providers, in line with the International Maritime Organisation, IMO, resolution A.891.

For semi submersible installations this will typically require, the Stability courses 1, 2 and 3 to be completed. Stability 3 including extensive damage control training on a ballast simulator. There should be a minimum of 2 persons on board with stability training appropriate to the type of vessel.

Dedicated maritime personnel would ideally include the OIM and an offshore Marine Supervisor, who reports directly to the OIM, both with a maritime background, and Ballast Control Operators. There should be a dedicated onshore marine superintendant who can be contacted at all times by the maritime personnel on the vessel.

Permanently moored installations in UKCS, such as an FSU or FPSO are considered to be fixed installations,