HID Inspection Guide Offshore Inspection of Temporary Refuge Integrity (TRI)

Contents  Summary  Introduction  Action  Background  Organisation  Targeting  Timing  Recording and Reporting  Appendix 1: TR design compliance and the identification and assessment of integrity management arrangements.  Appendix 2: TR Safety Management System (SMS)  Appendix 3: Implementation and maintenance of the TR management process  Appendix 4: Emergency Planning and Preparedness  Appendix 5: Inspection Issues  Appendix 6: Performance Assessment Criteria  Appendix 7: Performance Indicators  Appendix 8: Example of Performance Rating

(Appendices 1 to 4 are performance assessment elements)

Summary This guidance describes current key topic areas that inspectors should consider when they are inspecting offshore TR integrity management. It also sets out the success criteria against which duty holder performance will be rated for each of these elements. References are made to technical standards and other sources of guidance and information that inspectors should use to assess compliance with the law.

Introduction The aim of this Inspection Guide (IG) is to provide information and guidance to offshore inspectors to support the delivery of consistent and effective offshore installations temporary refuge (TR) integrity management interventions. It does this by highlighting current key areas to be covered during inspections, providing a

framework for inspectors to judge compliance, assign performance ratings, and decide what enforcement action to take should they find legislative breaches. In doing so, it complements HSE’s Enforcement Policy Statement (EPS) and Enforcement Management Model (EMM).

This IG follows HSE's existing TRI inspection practice, which breaks the topic down into the four core-intervention issues described in the appendices. These are:

1. TR definition and description. 2. TR Integrity, survivability (duration) and impairment analysis, the identification of safety critical elements. 3. Identification, establishment and implementation TR SCE performance standards. 4. The TR integrity management process: maintenance, inspection and verification.

Action Effective asset integrity management should be a priority for industry. A key objective for ED 3 Discipline Specialists is to ensure that the TR and associated safety critical equipment is designed, commissioned, operated, inspected and maintained to an appropriate standard.

ED 3.2 Specialist Inspectors will do this by:  encouraging industry to take proactive steps to manage the integrity of safety critical assets such as TRs effectively;  ensuring a targeted, proportionate and consistent programme of inspection agreed with offshore operators in their intervention plans;  sharing lessons learned from investigations / inspections; and  promoting the development and sharing of improved health and safety practices across the industry.

The inspection of TR integrity management should include examination of a broad range of activities. These include: TR design; commissioning; maintenance; inspection and demonstration of adequate integrity against impairment in relation to an installations Major Accident Hazard (MAH) consequence assessment; safe operating parameters; and the hardware/equipment and the wider management systems put in place by the duty holder.

Success criteria are listed under the inspection topics (see appendices); these cover the key issues that inspectors should consider when carrying-out inspections against each core intervention issue. In some instances, not all of the success criteria will apply so inspectors should make a judgement regarding which of these are relevant in each case. If the relevant success criteria cannot be met, inspectors should assess how serious the consequences of failure to comply could be. This will inform their decision making in terms of the performance ratings that they assign and the enforcement action they take (if any) based on the findings of the inspection.

This IG can also be used as a tool to help operators assess their own performance, for example by carrying out gap analyses against the success criteria listed or using them to identify safety performance indicators (SPIs) for TR integrity management. This will enable operators to proactively identify and take steps to rectify any potential weaknesses in their arrangements for maintaining TR integrity.

When carrying out inspections covered by this guidance inspectors should:  check the key issues against their success criteria in Appendices 1 to 4;  use the generic performance descriptors in Appendix 7 and the worked example in Appendix 8 to:  determine the appropriate performance rating; and  the initial enforcement expectation to use alongside the EMM.  consider how and when the issues raised during an inspection are to be closed out and recorded using the COIN issues tab;  assess the extent to which senior management leadership influences front- line safety.  where occupational health, safety and welfare concerns are encountered during an inspection, deal with such issues as a matter of routine and apply existing standards to determine what action to take in each case according to HSE's EPS and EMM.

Inspectors should use the HID generic performance descriptors to determine the appropriate performance rating for each of the four core intervention issues covered by this IG. The appendices also give guidance on the initial enforcement expectation and should be used alongside the Enforcement Management Model (EMM). The local factors that apply in each case will ultimately determine whether there should be any enforcement action. Consideration also needs to be given as to how and when the issues raised during an inspection should be closed out. Inspectors must adhere to the relevant operational guidance (e.g. on use of the COIN issues tab).

Background Duty holders are required to ensure all foreseeable integrity threats (Major Accident Hazards) are identified and their potential for TR impairment assessed. From this assessment, suitable and sufficient performance standards should be established for the components systems identified as safety critical. These elements and systems require adequate maintenance and inspection to sustain the specified integrity. Otherwise, the TR may fail to provide the protection required, during a major incident to prevent significant loss of life. Duty holders should also demonstrate that the TR has sufficient integrity to ensure impairment is as low as reasonably practicable (ALARP). The level of unreasonable impairment (risk) is indicated in APOSC is greater than 1x10-3/yr. This value has been established as a surrogate for societal risk it therefore includes all events capable of preventing TR functionality within the established time required for its survival.

The fabric and systems that make up a TR require adequate attention during their design and installation. During their operational life, they are subject to a range of degradation mechanisms and change. Unless carefully managed and recorded, what is considered to be the TR will become increasingly unclear, particularly in terms of

its ‘relevant boundaries’ and operational extent. The significance of this is that the TR is likely to fail to perform as required and may not provide the expected level of protection to its occupants against impairment from Major Accident Hazard (MAH) events as identified in the Operational Safety Case (Reg’12 or PFEER Reg’5 assessments).

Factors such as the severity and duration of hazard exposure and the TR’s resistance to impairment from such exposure are key issues1. The progressive deterioration of this resistance to impairment is referred to as 'ageing' and can be minimised by an adequate and appropriate integrity management program of test, inspection, maintenance, repair and replacement of relevant SCE’s.

A knowledge and understanding of TR integrity estimation is constantly evolving. At the same time, improved techniques to enable smoke, fume and noxious substance ingress to be estimated against the expected survivability are being developed. These are discussed later. One of HSE's important roles as a regulator is to ensure that duty holders harness this knowledge and make use of available technology and evaluation techniques to ensure ongoing control of risk to a level that is ALARP. In practice, this means that HSE expects duty holders to have arrangements in place to define and determine TR impairment resistance and then stay up-to-date with new techniques, technologies and systems and where appropriate to apply these to existing, as well as to new, temporary refuges. 1. See Offshore Information Sheets – 2/2006 & 3/2006: HSE Semi Permanent Circular “Indicative Human Vulnerability for use in Offshore Risk Assessment” and Appendix

TR Integrity Management For all persons onboard an offshore installation, the consequences of poor TR integrity management can be catastrophic. This is therefore an obvious priority for HSE and duty holders.

Integrity management begins with design and construction: a primary activity is the establishment of appropriate design / operational performance standards. For example:

o Porosity- The external surface of a TR contains many penetrations, holes and leakage paths to the outside. As the wind impinges on any of the TR faces the differential pressure induced on the windward face produces a net influx of environmental gas into the TR such that the TR “breathes” as a result of this and the lower pressure produced on the leeward side. Porosity is normally described in terms of the TR ‘Air Change Rate’ (ACR), normally carried out under specific weather conditions, or ‘Equivalent Air Change Rate’ (AC/heq) which is determined by manipulating the air change rate recorded during an appropriate pressurisation test. TR’s are porous and they will leak!

 Blast Resistance: the highest over pressure that the TR can withstand before critical structural loss of integrity occurs (by calculation at the design phase).

 Thermal Radiation Impairment: Where possible this defines the maximum intensity of radiation that the TR can withstand before its structure or, more likely, internal temperature results in impairment before a specified period of

exposure. This also includes the provision and maintenance of appropriate Passive Fire Protection (PFP) to internal or external surfaces of the TR to ensure adequate survivability. Note: insulation is typically fitted to the inside of TR for environmental and energy saving reasons. PFP is applied when a potential exposure to thermal radiation from MAH events, the type and application of such protection may be specific to the type of event (i.e. jet or pool fire) identified. Typically, heat transfer standards are defined by the fire resistance rating as detailed in the appropriate international standards (i.e. for “A”, “H” and “J” rating thermal radiation resistance).

 Internal effects impairment: this includes events such as fire (heat and combustion products) and cumulative effects during a MAH such as heat rise, O2 depletion and CO2 intensification (See SPC 30 and its annex for more detail).

 Other external events that impair the TR without affecting the integrity of the installation such as structural degradation and failure may include: helicopter crash and/or non process fire; and vessel impacts at vulnerable locations that have sufficient energy to render the TR unfit to perform its primary function.

TR Impairment Frequency (TRIF) is the sum of all TR impairment event probabilities. This allows comparison with the surrogate societal risk criterion stated in APOSC.

TR Impairment through smoke, fume hazardous or noxious gas ingress Following any MAH event, it is foreseeable that a “porous” TR is likely to be exposed to smoke, fumes and hazardous or noxious gases. Contaminated external air will mix with the air captured in the TR (from HVAC shutdown). Any contaminants carried with this air will begin to increase in concentration inside the TR as the two atmospheres gradually equilibrate. Eventually, the contaminants will reach the same concentrations inside and outside of the TR. It is assumed that once these contaminants reach equlibrium levels, persons inside the TR will become impaired. This could occur in less time that the stated endurance period.

The minimisation of TR impairment is dependant on the presence of adequate Safety Critical Elements (SCE’s), including components and/or systems, that should be identified, evaluated, specified, inspected and maintained to ensure that they meet specific Performance Standards (PS’s). Such systems include but are not limited to:

 HVAC: particularly:

o All external Inlet, outlet and ductwork integrity. o All external fire damper / louvre closure effectiveness (including louvre seal condition and actuation systems (automatic and manually activated) – see HSE Information Note (I.N.) 1/2006. o Flammable/Toxic gas and smoke detection – see HSE I.N. 5/2008.

o ESD shut down effectiveness including overall response time; time from gas at HVAC inlet, to detection, notification (to emergency control), and effective emergency action completed. o Confirmation of ESD action and notification of failure(s) to emergency control. o Overall reliability (often described as probability of failure on demand). o HVAC over pressurisation. Where over pressurisation is possible there is an increase propensity for door /frame and associated seal damage and reduced life span.

Other factors contribute to the overall porosity of the TR and these should be treated in a similar manner when present. These include, but are not limited to (and may or may not be present on an installation):

 External doors, seals and framework including “Air Lock” systems.

 Cable & pipe work penetrations.

 Waste water pipes and liquid seals.

 External windows and frames (external means external to the TR see below).

 External cladding/sheeting corrosion & degradation. Note: “external” means external to the TR - it does not always just apply to surfaces exposed to the environment. Where the TR is separated from other areas of an installation, it is essential to ensure adequate materials and standards of sealing are employed: decorative or internal panels may be unsuitable for this purpose. For example, a TR can be separated from utility systems sharing the same overall structure; as in an FPSO where the engine room and power generation may be part of the superstructure. In such circumstances, a DH should ensure the TR is protected against impairment from any events that could occur in such locations. Historical records would indicate that engine room and generator engine fires are foreseeable.

Other systems also contribute to smoke & fume impairment detection, prevention and mitigation from external & internal events and include:

 Automatic fire detection and suppression systems.

 Smoke & gas detection at access/egress points, muster areas and emergency control centre(s).

 Fire fighting equipment (dry risers, hoses and portable FFE).

 TR Oxygen generation / supply or CO2 scrubbers (not typical at present on the UKCS).

 Electrical equipment condition checks.

 Control systems to prevent the presence of flammable or combustible materials (as an alternative to fire suppression systems).

Note: use of the fire-teams as an alternative to any of the above is considered a lowering of safety standards and contrary to the hierarchy of risk control and therefore, not acceptable.

TR design compliance and the identification and assessment of integrity management arrangements The design of the TR (and any modifications to it) must be appropriate for its use. The design specification should take into account the operating regime for the TR, the conditions under which it is required to function and the environmental extremes to which it will be exposed.

TR design is the starting point for establishing effective arrangements for ongoing inspection, testing and maintenance activities. For example, maintaining the integrity and demonstrating the fitness for service of a TR that is not designed with an appropriate ACR blast resistance or PFP requirement can be a significant challenge. If fitness for service cannot be assured, the TR cannot be deemed appropriate. Whilst these design considerations may not have been considered in the past, design specifications that required a TR to meet a specific equivalent air change rate is provided in I.N. 2006 and should be encouraged.

Another key design consideration is the TR’s survival time and related safety features (SCE’s) e.g. those provided to prevent impairment of its occupants. Typically, a TR will not be designed to provide ABSOLUTE protection to its occupants, as low probability / high hazard events may result in TR impairment within the specified survival time.

Relevant Legislation

 Health & Safety At Work etc Act 1974 This is the primary piece of legislation covering work-related health & safety in the UK.

 The Management of Health & Safety at Work Regulations 1999 These set out broad general duties that apply to most work activities. They require employers to assess the risks to employees posed by all work activities to enable the provision of preventative and protective measures.

 The Offshore Installations and Wells (Design and Construction etc) Regulations 1996 places goal-setting duties on installation owners and operators to ensure the integrity of an installation throughout its lifecycle.

 The Offshore Installations (Safety Case) Regulations 2005 (SCR05) create a range of duties on duty holders, many of which relate directly TR integrity, survivability and impairment evaluation and estimation.

 The Prevention of Fire, Explosion and Emergency Response Regulations 1995 (PFEER) creates additional duties and of these, the following are key requirements, which have been the subject of HSE enforcement activity or where failure to comply has been a significant factor in the loss of the required TR integrity.  Regulations 4 places a general duty on a duty holder to take appropriate measures with a view to protecting persons on the installation from fire and explosion; securing effective emergency response.  Regulation 5 requires an assessment to enable the adequate performance standards for the TR to be established for protecting persons in the event of fire or explosion.  Regulation 13 requires the TR to appropriately protect persons during a MAH (fire/explosion) and remain effective during such an emergency.  Regulation 19 requires the TR to be adequate for purpose (link with DCR) and be maintained in an efficient state, efficient working order and in good repair.

 The Provision and Use of Work Equipment Regulations 1998 (PUWER) Regulation 6 imposes duties relating to the inspection of work equipment (including HVAC systems) and maintaining records of these inspections.

 The Supply of Machinery (Safety) Regulations 2008 places duties on machinery suppliers and manufacturers to ensure that all new machinery placed on the market or put into service is safe. This includes second hand machinery which is new to the European market (imported from outside the EEA and put in service in Europe for the first time.

Organisation Targeting Inspections should be carried-out in accordance with ED duty holder intervention plans.

Timing Inspectors should undertake TR inspections as part of the agreed ED Offshore Intervention Plan; when intelligence indicates