1383

3
PROCESSES
VERIFICATION
ASSURANCE
ENGAGEMENT
WORKFORCE
MANAGERS
INDEPENDENT
VERIFIERS
ASSET INTEGRITY
ASSURANCE & VERIFICATION

Annual Review
PRACTITIONERS
GUIDE 2010
Managing Risks to prevent and minimise
the impact of Major Accidents
OUR VISION
Making the UK the

safest place to work
in the worldwide oil
and gas industry
Step Change in Safety - Assurance & Verification Practitioners Guide
Foreword
Offshore Oil and Gas is a unique industry where Operators and a wide range of supporting personnel, from
catering staff to technical specialists, work and live for extensive periods of time in relatively close proximity to
large inventories of flammable, explosive and sometimes toxic substances. They face significant challenges in the
event of an emergency when there is an urgent need to distance themselves quickly from the hazard, because of
a compact and complex site, and the need to evacuate or escape by air or sea should it become necessary. It is
therefore apparent that offshore installations demand a high level of attention to risk management.
Following the fire and explosion on the Piper Alpha platform in July 1988, when 167 lives and the entire installation
were lost, the enquiry into the disaster raised 102 recommendations. These were endorsed by the government
and led to a suite of new goal setting safety Legislation which forms the framework used today to address and
manage the risks of Major Accident Hazards (MAH) on Offshore Oil and Gas installations within UK waters. These
Regulations specifically introduced the concept of Safety Critical Elements (SCEs).
In recognition of the unique risks faced by the industry, additional requirements for the examination of safety plant
and equipment, by Independent and Competent Persons (ICPs), which does not exist in any of the other high
hazard industries, was placed in Law. This process is called Verification. At the same time, requirements were set
for Duty Holders to review their processes, involving routine maintenance and inspection and testing to minimise
MAH risk. These are referred to as Assurance activities and are often encompassed within the overall Verification
Scheme, which can lead to some confusion over roles and responsibilities of the Duty Holder and the ICP.
Following a major review by the UK Health and Safety Executive, between 2004 and 2007, of the condition of
safety equipment and the supporting management processes, it was expressed that Verification was not delivering
the benefits expected by Stakeholders. This challenge was taken up by the industry through Step Change in Safety
and a 2 year programme of work (2010 - 2012) was undertaken to improve the understanding and awareness of
the benefits of good assurance of integrity by Duty Holders, and Verification by ICPs; involving contribution from
Operators, ICPs, the HSE and contractors.
This suite of guidance is made available to the industry through Step Change in Safety and is designed to support
those who wish to improve their understanding of the processes for Assuring and Verifying the integrity of our
offshore installations.
As the UK Offshore Oil and Gas industry progresses into a sixth decade of operation, we have become a mature
basin with an ageing infrastructure and many installations operating beyond their original design life, in some
cases, with new or changing Operators. In consequence, we have an increasing need to continually improve
processes and engagement by all parties, to raise the understanding of the changing condition and capability of
plant, and to allow the right actions to be taken to assure the integrity of our installations.
ACKNOWLEDGEMENTS
This document could not have been produced without substantial valuable contributions from many people with
knowledge of Assurance and Verification. However, these subjects have been discussed for many years since MAH
Management Legislation was issued and significant best practice has since evolved. There is substantial passion
amongst the community of Engineers to do it right, however, it is clear that the interpretation of what is right
is very difficult to agree. The text that has been developed in this document is the result of intense activity by
many people and it is unlikely that any one of them will fully agree with the entire content. What follows is not
a definitive guide, but represents the opinions of people who have worked with the UK offshore Legislation and
managed SCEs for many years, and provides perspective and guidance to those seeking help.
Contributors to the development of this document include the following:
AMEC
Apache North Sea Limited
BG Group
BP North Sea
Britannia Operator Limited
Bureau Veritas
Centrica Energy
Chevron Upstream Europe
ConocoPhillips (UK) Limited
Diamond Offshore Drilling
DNV
Ensco
ExxonMobil
GDF SUEZ E&P UK Ltd
GL Noble Denton
The Health and Safety Executive
IMES
Lloyds Register EMEA
Maersk FPSOs
Maersk Oil
Nexen Petroleum UK
Oil and Gas UK
Perenco UK - SNS
Petrofac
Plant Integrity Management
Shell U.K. Limited
Step Change in Safety
Talisman Energy (UK) Ltd.
TAQA Bratani
Total E&P UK Ltd
Transocean
Wood Group
CONTENTS
1.
TERMS, ABBREVIATIONS AND REFERENCES
2.
INTRODUCTION, SCOPE AND OBJECTIVES
3.
OFFSHORE UK LEGISLATION
4.
MANAGING MAJOR ACCIDENT HAZARDS THROUGH BARRIERS
15
5.
PERFORMANCE STANDARDS
17
6.
ASSURANCE AND INTEGRITY MANAGEMENT
34
7.
VERIFICATION - SUPPORTING THE ASSURANCE PROCESS
41
8.
VERIFICATION - RELATIONSHIPS AND COMMUNICATION
56
9.
TRAINING, COMPETENCE AND ROLES AND RESPONSIBILITIES
60
10. MANAGEMENT OF CHANGE
64
11. TEMPORARY EQUIPMENT EQUIPMENT REQUIRED OFFSHORE FOR A SHORT PERIOD
68
Appendix 1
75
Examples of Verification Benefits
75
Terms and Abbreviations

ACOP
ALARP
COMOPS
DCR
DECC
DH
EC
ESD
ESDV
F&G
FARSI
FPSO
FPU
FRA
GA
HAE
HAZID
HAZOP
HID
HSE (without The)
HVAC
ICP
ICSS
IVB
KPI
MA
MAH
MAR
MIST
MOC
MOU
MMS
MTBF
NDT
OEM
OPPS
PA
PFD
PFEER
PMR
4
Approved Code of Practice

As Low As Reasonably Practicable
Combined Operations
The Offshore Installations and Wells (Design and Construction, etc) Regulations
Department of Energy and Climate Change
Duty Holder
Engineering Contractor
Emergency Shutdown
Emergency Shutdown Valve
Fire and Gas
Functionality, Availability, Reliability and Survivability (Performance Standard model)
Floating Production, Storage and Offloading (vessel)
Floating Production Unit
Fire Risk Analysis
General Alarm
Hazardous Area Equipment
Hazard Identification Study
Hazard and Operability Analysis
Hazardous Installations Directorate
Health, Safety and Environment
Heating, Ventilation and Air Conditioning
Independent and Competent Person (this is often interchanged with Verifier and
also IVB meaning Independent Verification Body and should be considered to mean the
same)
Integrated Control Safety System
Independent Verification Body (see also ICP)
Key Performance Indicator
Major Accident
Major Accident Hazard
The Offshore Installations and Pipelines Works (Management and Administration)
Regulations
Minimum Industry Safety Training
Management Of Change
Mobile Offshore Unit
Maintenance Management System
Mean Time Between Failure
Non-destructive Testing
Original Equipment Manufacturer
Overpressure Protection System
Public Address
Probability of Failure on Demand
The Offshore Installations (Prevention of Fire and Explosion, and Emergency Response)
Regulations
Planned Maintenance Routine
POB
PS
PSR
PT
PTW
PUWER
QA
QRA
RAR
RBI
RCA
SCEs
SCR / OSCR
SIL
SOLAS
Specified Plant
The HSE
TA
TE
TR
UPS
WSE
Personnel On Board
Performance Standard
Pipeline Safety Regulations
Pressure Transmitter
Permit to Work
Provision and Use of Work Equipment Regulations
Quality Assurance
Quantitative Risk Analysis
Remedial Action Recommended
Risk Based Inspection
Root Cause Analysis
Safety Critical Elements, including Specified Plant as appropriate
The Offshore Installations (Safety Case) Regulations
Safety Integrity Level
Safety of Life at Sea
Specific safety related plant and equipment as defined in PFEER, Regulation 2
The Health and Safety Executive
Technical Authority
Temporary Equipment
Temporary Refuge
Uninterruptible Power Supply
Written Scheme of Examination
References
The Public Inquiry into the Piper Alpha Disaster - Lord
W Douglas Cullen
Plant Ageing: Management of equipment containing
hazardous fluids or pressure - Research Report RR509
HSE Books 2006
Step Change - The Asset Integrity Toolkit
Energy Institute Guidelines for the management of
safety critical elements (2nd Edition)
Energy Institute Research report: A framework for
monitoring the management of ageing effects on
safety critical elements
A guide to the Offshore Installations (Safety Case)
Regulations 2005
Successful health and safety management (HSG 65)
HSE 1997
1998 (PUWER)
known as ATEX 95)

Directive 99/92/EC The ATEX Workplace Directive (also
known as ATEX 137)
HSE Offshore Information Sheets 4/2009 (Guidance
on management of ageing and thorough reviews
of ageing installations) and 5/2007 (Ageing semisubmersible installations)
HSE Nature and Frequency of Verification of Safety
Critical Elements HID Semi Permanent Circular SPC/
Enforcement/43
A guide to the well aspects of the Offshore Installations
and Wells (Design and Construction, etc) Regulations
1996
A guide to the installation Verification and
miscellaneous aspects of amendments by the Offshore
Installations and Wells (Design and Construction, etc)
Regulations 1996 to the Offshore Installations (Safety
Case) Regulations 1992
Directive 94/9/EC The ATEX Equipment Directive (also

5
2. INTRODUCTION, SCOPE AND OBJECTIVES
The current suite of applicable Offshore Safety Regulations and the associated risk management processes were
developed following the enquiry into the Piper Alpha disaster, for the identification and management of the
hazards which could lead to Major Accidents. This is internationally recognised as a best practice and is widely
utilised by other countries in the development of their own Regulatory regimes. However, in the period since 1992
when these Regulations started to be issued and take effect, there has been a wide variance in understanding of
the content and interpretation of the expectations for implementation. The current safety regime was intended to
put in place mandatory requirements which, if followed correctly, would reduce the likelihood that such a Major
Accident could happen again.
The Offshore Installations (Safety Case) Regulations

(2005)
Pipeline Safety Regulations (PSR, 1996)
Offshore Installations and Pipeline Works

Management and Administration) Regulations (1995)
Health and
Safety at Work
etc Act (1974)
Prevention of Fire and Explosion and Emergency

Response on offshore installations (PFEER, 1995)
Offshore Installations and Wells (Design and
Construction, etc) Regulations (DCR, 1996)
(PUWER, 1998)
Figure 1 - UK Legislation
The management of Major Accident Hazards (MAHs) represents critical activities to support the low probability
high consequence events which require a different approach to the occupational, or personal, safety management
processes and programmes which are associated with higher frequency but lower consequence events. The basic
reason for this is that while single failures can cause dangerous occurrences, Major Accidents do not generally
happen as a result of a failure of one piece of equipment or one wrong action by an individual. Instead, they are
epitomised by a series of failures of plant, personnel functions and processes and procedures. Following a major
accident, it is not unusual for personnel within a company to reflect that all the signs of the likelihood of the
eventual accident were evident but the operating company and personnel had not been able to recognise this and
make the necessary changes to plant, people and processes, which become obvious and natural to do, after such
an accident.
While substantial improvements in safety have been achieved as a result of the application of the OSCR, the level
of understanding and interpretation has been shown to vary significantly amongst those holding responsibilities. In
particular, the requirement for ICP Verification of key plant performing safety critical functions needs to be clearly
understood and consistently applied.
Following a major review of the condition of safety equipment and supporting management processes undertaken
by the UK Health and Safety Executive between 2004 and 2007, it was expressed that Verification was not
delivering the benefits expected by Stakeholders.
In consequence, an initiative was developed by the Step Change in Safety Asset Integrity Steering Group to
create a subgroup with a scope of investigating the challenges faced and developing guidance for use by the
industry for the purpose of:
Raising understanding of the framework for MAH Management
Improving understanding of the Roles and Responsibilities of the Duty Holder in assuring the performance of
SCEs
Clarifying the role and function of the ICP
Providing a reference document for use by Duty Holders and ICPs
The Assurance and Verification Subgroup was formed in 2010 with a wide industry involvement of Operators, Drilling
companies, key service suppliers, ICPs and the HSE, who all had passionate opinions on the processes of Assurance
and Verification. A two-year programme was set to investigate the challenges faced, share understanding through
regular meetings and develop guidance and education material with the objective of improving understanding of
the best practices being used in the industry.
At the outset, the Subgroup sought to identify the main areas of focus to be addressed and these are reflected in
this suite of documents. The following areas were identified for specific attention:

Improving understanding of MAH barriers related to SCEs
Clarifying the Assurance and Verification processes to all industry personnel
Improving:
- understanding of MAHs
- the content and quality of Performance Standards
- control of Temporary Equipment
- understanding of the importance and the basic process for Management of Change with respect to the
management of SCEs

Providing guidance on training and competency needs for ICPs and Duty Holder personnel
To discuss relationship & communication matters between Duty Holders, ICPs and other stakeholders which
impacts on the effectiveness of Verification.
In general, the aim of the identified focus areas was to raise awareness of how everyone can contribute to MAH
safety management through better understanding of SCEs and their functions
To meet the needs of different Stakeholders it was decided to produce three documents.
The first is in the form of a high level overview to provide a short and simple summary to communicate the
basic messages of Assurance, Verification and Major Hazard Management so that any reader can quickly gain an
awareness of the framework and recognise the importance of their involvement and how they can participate in
reducing risk.
A second document provides more detail on the framework by explaining the intent behind the Regulatory
requirements and may be used by those who need to raise their understanding of the expectations of Assurance
and Verification functions to comply with the OSCR and the benefits this brings to both safety and production.
This is targeted at those who need a working understanding of the principles to support the compliance processes.
The third document (this document) is intended as a reference manual to provide more detailed guidance on
how to implement Assurance and Verification, drawing on good practices provided through the participating
companies in the UK Offshore Oil and Gas Industry for managing the suitability of plant and equipment. It
is intended to provide an outline of the fundamental activities and relevant key principles which should be
considered, raising a wider industry awareness of MAH management and sharing good tried and tested processes,
without prescriptively and specifically defining how it should be done. This document is targeted at those with
responsibility for developing and managing activities in support of Assurance and Verification.
To gain a full understanding of the regulatory requirements, reference should be made to the relevant Statutory
Instruments and Guidance printed by the HSE and referenced in these documents.
It should be noted that following these guidelines will support, but not guarantee, compliance with UK law.
3. OFFSHORE UK LEGISLATION
The Offshore Installations (Safety Case) Regulations (OSCR)

Fixed and mobile offshore installations operating within UK waters are required to have a Safety Case which
has been accepted by the HSE. The purpose of this document is to provide an overview that demonstrates both
internally to the Duty Holder and co-venturers, and externally to the Regulatory Authorities, that a series of formal
assessments have been made to ensure that the facilities design and the Companys management systems are
consistent with the requirement for safe and responsible operation, and that the Duty Holder has both the
ability and means to control major accident risks effectively. It also provides the strategy for safe operation of the
installation, which the Duty Holder intends to undertake to ensure compliance with relevant statutory provisions
and risks to personnel are As Low As Reasonably Practicable (ALARP).
Full details of the specific requirements of the OSCR may be found in A guide to the Offshore Installations (Safety
Case) Regulations 2005. The following presents some of the key requirements which have been paraphrased
in order to provide a high level understanding of the expectations of these Regulations. These should not be
considered to replace or fully represent the legislative requirements:

An HSE accepted Safety Case is required to be in place for a production or non-production installation before
it moves into, or commences operation in, the UK offshore sector
The content of an Operations phase Safety Case principally requires the following:
- full description of the installation and its boundary
- description of its operations
- numbers of personnel
- description of plant and arrangements for control of well operations
- descriptions of associated pipelines
- details of how the Duty Holder complies with PFEER (see below)
- details of arrangements for protecting personnel from toxic gas
- details of arrangements for protection of personnel remaining on the installation during the escalation
of hazardous situations arising from major accident related hazards, including Temporary Refuge (TR),
routes and means for egress and evacuation, and means for control within the TR
- details of how the Duty Holder will assure compliance with associated offshore Legislation: DCR, PSR, and
in particular how the Duty Holder assures suitability of SCEs
- descriptions of combined operations
Demonstration of how the management system assures compliance with statutory provisions by the
Company and arrangements for assuring contractor compliance. Arrangements for audit and report, and the
identification of hazards with the potential to cause major accidents, and evaluation of the associated risks
and provision of means provided to manage these

Notifications are required to be submitted to the HSE for design, relocation or conversion of non-production
installations, combined operations and well operations
A revised Safety Case is required in some circumstances, but particularly where material change occurs, when
directed by the HSE or for the dismantling phase of a fixed offshore installation
A thorough review of Safety Cases is required every 5 years, or earlier if directed by the HSE. The review
involves confirmation that the Safety Case as a whole continues to be fundamentally sound and is over and
above the requirement to ensure that the Safety Case is up-to-date
Duties are placed on the Licence Owner to ensure that any Operator appointed by them is complying with
legislative requirements
The Verification Scheme is in place and operating as required
Verification applies to the entire offshore installation. The definition of an offshore installation includes:
- any part of a pipeline and associated apparatus within 500m
- any devices beyond 500m, on which the safety of the installation depends
- the plant and arrangements for the control of operations of a well
- connected wells
The Offshore Installations (Prevention of Fire and Explosion, and Emergency Response)
Regulations (PFEER)
These Regulations require that the Duty Holder takes appropriate measures with a view to protecting personnel on
the installation from fire and explosion and securing effective emergency response. The Duty Holder is required to:
Perform an assessment to identify events which could give rise to a Major Accident involving fire or explosion;
or the need for evacuation, escape or rescue to avoid or minimise the consequences of a Major Accident
Evaluate the likelihood and consequences of such events
Establish appropriate standards of performance to be attained by anything provided by these measures for:
(i) ensuring effective evacuation, escape, recovery and rescue to avoid or minimise a Major Accident
(ii) otherwise protecting persons from a Major Accident involving fire or explosion
(iii) the selection of appropriate measures
The plant and equipment required to meet the needs of PFEER and defined in the Safety Case are normally also
included in a common Written Scheme of Examination for completion of Assurance and Verification activities, as
these are also SCEs.
The Offshore Installations and Wells (Design and Construction, etc) Regulations (DCR)
These Regulations require all wells to be covered by a Well Examination Scheme. The Duty Holder for these
Regulations is the Well Operator.
Wells connected to an installation are deemed safety critical under the Safety Case Regulations and should be
included in the Verification Scheme for the installation. However, both DCR and the Safety Case Regulations make
it clear that the work carried out in one Scheme may be cited as part of the other Scheme and that duplication or
repetition is not expected.
It is good practice for one Scheme to reference the other, eg the Verification Scheme ICP receives a copy of the
well examination certificate even though they do not actually carry out any Verification activities on the well or
well component parts. During its lifecycle, a well or its component parts may move between the Well Examination
Scheme and the Verification Scheme. It is therefore essential that the Well Operator and any installation Duty
Holder are aware at all times of which wells are covered by which Scheme.
Well Examination represents the activities performed by the Well Examiner, an Independent and Competent
Person appointed by the Well Operator, to establish that wells are designed, constructed, commissioned, operated,
maintained, modified (including interventions and workovers) and abandoned in accordance with the Design and
Construction Regulations. Verification activities may be used as evidence in supporting well examinations.
10
Major Accidents Hazard Management overview

The OSCR defines the concept of a Major Accident and this is paraphrased as follows:
Death or serious personal injury due to fire, explosion or dangerous substance release
Major damage to structure or plant, or loss of stability of the installation including well blowout, loss of
containment or well control
Helicopter collision
Failure of diving operations life support systems, detachment of a diving bell or trapping of a diver
Any event involving death or serious personal injury to five or more people
Major Accidents represent events which cause death, serious injury or major damage to plant. Such accidents
cannot happen without exposure to hazards such as fire, explosion, toxic substances, weather, diving activity or
ship movements. The OSCR requires that these hazards and the potential consequences of their realisation must be
defined. Having established these scenarios, it is then possible to define strategies for minimising the risk of their
occurrence through safety studies and the provision of careful design, key safety plant and equipment, and good
operations and maintenance processes. These strategies effectively provide the basis by which risks are managed
through elimination, prevention, detection, control, mitigation and finally rescue and recovery means.
Safety Critical Elements (SCEs)

The key safety plant and equipment required to manage risk is identified from these strategies and these are the
Safety Critical Elements, defined in the Safety Case Regulations as:
such parts of an installation and such of its plant (including computer programs), or any part thereof
(a) the failure of which could cause or contribute substantially to; or
(b) a purpose of which is to prevent, or limit the effect of, a major accident
Major Accident Hazards (MAH) are established from a Hazard Identification study (HAZID). SCEs are identified from
analysing those Hazards, and constitute the means required to manage the associated risks. Examples of SCEs and
relevant associated equipment (sometimes referred to as sub elements), as shown in Figure 2 overleaf (Note that
this is not intended to be a complete list).
11
Identification of Safety Critical Elements

Hazard
Identification
& Assessment
Primary
Major
Hazards
Fire
Safety Critical Elements & Sub Elements
Process Containment
Process Containment
Ignition Control
Ex. Certified Equip.

Electrical Tripping Equip.
Earthing & Bonding Equip.
Explosion
Major
Accident
Scenario
Major
Accident
Hazards
Helicopter
Crash
Ship
Collision
Structural
Failure
Major
Accident
Register
Dropped
Objects
Turbine Disc
Failure
Well Blowout
Process Flow
12
Figure 2 - Identification of Safety Critical Elements
Safeguarding systems
Process Shutdown System

Emergency Shutdown System
Fire & Gas Alarm System
Fire Protection
Water Fire Fighting HVAC

Chemical Fire Fighting TR
Passive Fire Protection
Navigational Aids
Seacraft
Structures
Support Structures
Facility Structures
Explosion Protection
Lifting Equipment
Cranes
Lifting Gear and Beams
Rotating Equipment
Turbine for Compressors

Turbine for Generators
Communications
Equipment
Radios
Telephones
Public Address
Escape, Evacuation
And Rescue Equipment
Lifeboats
Life Rafts
Helicopter Rescue Box
Personal Safety Equipment
Well Control &

Containment
Well and Components e.g.

Xmas Tree, Wellhead, Casing
Annuli, BOP
Performance Standards
Having identified the key items of safety critical plant and equipment (the SCEs), it is now prudent to define
the functions they are required to perform and confirm the actual equipment is capable of consistently and
continuously performing those functions. This is defined in the Performance Standards (one for each SCE) which is
the commonly accepted method of describing what an SCE must achieve. SCEs are assessed against Performance
standards through the Assurance and Verification activities, to give an adequate level of confidence that they will
fulfil their intended purpose whenever required. Refer to the Performance Standards section (Page 17) for further
information on Performance Standard setting.
Assurance represents the activities performed to ensure SCEs meet Performance Standards. This includes
activities in all phases of the lifecycle and may involve activity by the design contractors in the design, procurement
and construction phases which the Duty Holder needs to monitor to ensure the SCEs are initially suitable.
During the operational phase, the Duty Holder uses preventive maintenance strategies including inspection,
planned maintenance and testing to ensure that SCEs are consistently and continuously meeting the Performance
Standard requirements. Assurance also includes design and construction of modifications and the management
of change to manage the impact on SCEs, and this is normally controlled through the use of a Management of
Change (MOC) process.
Verification represents the activities, in addition to Assurance, which are performed by an ICP, appointed
by the Duty Holder, to confirm whether the SCEs will be, are, and remain suitable, or are adequately specified
and constructed, and are being maintained in adequate condition to meet the requirements of the Performance
Standards.
The steps involved in Major Accident Hazard Management outlined above are illustrated in Figure 3 below.
Assurance Activities
Integrity Reporting
Procurement, Construction,
Operations
Maintenance
Inspection
Compliance
Processes
Safety
Case
Independent
Verification
Definition
Major
Accident
Hazards
Performance
Standards
Safety
Critical
Elements
Figure 3 - Major Accident Hazard Management

13
In summary, Major Accident events should be identified in the Safety Case together with the means used to
prevent, detect, control, mitigate, rescue or help recover from a Major Accident which effectively become the
SCEs. Performance Standards define the specific functions which SCEs must perform, and Assurance activities
support the demonstration of continuous suitability to perform those functions.
All personnel should develop a level of understanding of how their safety is assured through the Safety Case,
and the reliable performance of SCEs in accordance with Performance Standards in performing key functions to
minimise the consequences of realised MAHs. This understanding will help personnel appreciate the importance of
the SCEs and help understand how they can support and assure safety within their own job roles, bringing benefits
in safety to all involved.
14
4. MANAGING MAJOR ACCIDENT HAZARDS

THROUGH BARRIERS
Based on historical findings from Major Accidents, such events do not occur solely as a result of a single failure of
plant or one individuals mistake. Such accidents require the failure of a combination of processes, plant integrity
and people activities, often referred to as the barriers between the hazard and the occurrence of an accident.
Many initiatives have been undertaken to develop models to describe how the complex interaction of safety
systems can avoid the initiation and escalation of an event leading to an accident.
The key and common building blocks amongst these concepts are the identification of:
PROCESS the setting of standards and expectations through management
processes and procedures, and;
PEOPLE
the organisational culture established, the values adopted and the way
people behave and the functions they perform, and;
PLANT
the provision of suitably designed and constructed plant to adequately

meet defined needs and the condition in which it is maintained.
Together, if managed effectively, these building blocks can reduce the risk of occurrence of a Major Accident.
Combined individual failures provide a route for the initiating hazard to become an accident. Intervention at any
one of these failures may have arrested the event from occurring or reduced the consequences; because each
identified failure mechanism represents a barrier between the hazard and consequential harm. Some examples
of plant barriers (SCEs) are shown below and the holes in the barriers reflect a path or route through which the
hazard is realised. This is referred to as the Swiss Cheese model and is the concept defined by James Reason.
Figure 4 refers to a specific Loss of Containment Major Accident Event.
DETECT
Gas/Flame
Detection
PREVENT
Containment
CONTROL
ESD
Blowdown
MITIGATION
Fire Protection,
Deluge
RESCUE &
RECOVERY
Lifeboat, Rescue
boat
Release
Hazard
Event
Figure 4 - Barrier Model
15
4. MANAGING MAJOR ACCIDENT HAZARDS

THROUGH BARRIERS
An example of how degradation of barriers (illustrated as holes) might provide a path to cause a Major Accident
is explained below, where each sentence describes an impaired barrier through which the hazard moved and
escalated. When reading, reflect on how a fully operating barrier without defects (or holes), might have prevented
an accident or reduced the magnitude of its consequences:
A gas flow line was incorrectly assessed to identify likely areas where corrosion might occur and the area where
corrosion actually occurred was not examined. Following completion of the inspection, the Engineer assessing the
results did not have the competence / experience to recognise this. The corrosion eventually led to a breakout of
gas (PREVENTION barrier failure).
A number of gas detectors in the area had been inhibited due to ongoing work in the area. Persons responsible
for assuring temporary battery-operated detectors did not adequately check their function (DETECTION barrier
failure).
Electrical equipment normally designed to avoid electric discharges had not been maintained or incorrectly
maintained, leading to a spark which ignited the gas in the area (CONTROL barrier failure).
The ensuing fire escalated because the water deluge piping and nozzles provided were blocked by rust and scaling,
and failed to perform as intended (MITIGATION barrier failure).
The above scenario could continue into the later stages of the developing accident to identify further barriers which
may succeed or fail, such as communication systems, emergency shutdown of plant, process blowdown to reduce
the gas inventory available to the accident, HVAC dampers to avoid ingress of smoke to the Temporary Refuge,
evacuation and escape routes, and throughout these, the defined management procedures which document
actions to be taken, and the functions people do or do not do.
Each stage reflects the failure of a barrier, whether People, Process or Plant and this demonstrates the importance of
maintaining the health of such barriers to avoid the initiation and escalation of events leading to Major Accidents.
Good barrier performance can be achieved through the adoption of well written performance standards and
assurance and verification procedures, adhered to by people who are competent for their defined roles in
maintaining and assuring the performance of safety critical equipment. The following sections will describe in
more detail how this can be achieved.
16
5. PERFORMANCE STANDARDS
Introduction
Having identified and agreed the appropriate SCEs according to the process described in the previous section, it is
necessary to define what they must do. The most commonly accepted process to effectively define this is through
the use of Performance Standard templates with specific and tailored criteria to ensure that there is consistency
and alignment regarding what an SCE must achieve to fulfil its role in hazard management.
What is a Performance Standard?

PFEER Guidance Para 45 states:
A performance standard is a statement, which can be expressed in qualitative or quantitative terms, of the
performance required of a system, item of equipment, person or procedure, and which is used as the basis
for managing the hazard - eg planning, measuring, control or audit - through the lifecycle of the installation.
The regulation does not specify what performance standards should be - that is for the Duty Holder to decide,
taking account of the circumstances on the particular installation.
This means that any SCE needs an associated Performance Standard which describes the essential requirements
that must be maintained or provided on demand, throughout the lifecycle of the installation.
For a Performance Standard to be suitable it should satisfy all of the following conditions:
a) Scope and functionality of the system shall be described / defined
b) Criteria shall be specified for each safety critical component and these criteria should have a clearly defined
(technical) basis
c) Parameters shall be measurable / auditable with defined acceptance criteria
d) Measured parameters shall provide evidence of the ability of the component / system to meet its minimum
requirements and hence to prevent or limit the effect of a Major Accident
Why do we need Performance Standards?

PFEER Reg.5.2(c) specifically refers to Performance Standards, as follows:
(2) An assessment (of the Major Accident Hazards) shall consist of(c) the establishment of appropriate standards of performance to be attained by anything provided by measures
for (i) ensuring effective evacuation, escape, recovery and rescue to avoid or minimise a major accident;
SC Regulation 2.5 states:
A Verification Scheme is a reference to a suitable written scheme for ensuring, by means described in paragraph
(6), that the safety-critical elements and the specified plant (a) are or, where they remain to be provided, will be suitable; and
(b) where they have been provided, remain in good repair and condition.
Performance Standards:
Are a legal requirement for PFEER-related elements. They are also the commonly adopted means to meet the
requirements of the Safety Case Regulations for ensuring SCE suitability
Provide a robust means to manage our major hazards and their associated risks
If each SCE meets its Performance Standard at all times, the likelihood of a Major Accident on a facility is reduced.
The reverse is also true. Failure of an SCE to meet its defined Performance Standard increases the likelihood and /
or the potential consequences of a Major Accident occurrence.
Dangers arise from a poorly defined Performance Standard. If it is difficult to measure, if important aspects /
issues are missing, or if it is difficult to understand, the Performance Standard may be ineffective or even ignored,
increasing the possibility of a Major Accident.
17
How are Performance Standards created?

Performance Standards and SCEs are commonly grouped by Barrier Type; namely Prevention, Detection, Control,
Mitigation and Emergency Response; meaning that these provide barriers of protection from Major Accident
Hazards, as shown in Figure 4. This is the basis used in building the following guidance on developing Performance
Standards.
Which Phases of the Lifecycle do Performance Standards cover?

The identification of Safety Critical Elements is a key building block within the installations Safety Case and a
Performance Standard should be developed for each SCE. Appropriate Performance Standards are required for
SCEs over their full lifecycle and it is important to ensure safe transition between lifecycles phases:
Design
Transportation and Construction (onshore and offshore)
Hook-up and Commissioning
Operations
Modifications
Repair
Life Extension
Preservation
Decommissioning and Abandonment
Procurement (all lifecycle phases)
What should be considered for an effective Performance Standard?

Performance Standards need to be defined in a consistent and logical manner. It is likely that more than one
parameter will be needed to detail the required performance of the SCE as a barrier. The codes, standards and
specifications used in the original design of SCEs should be identifiable from the Performance Standards so that
suitability can be maintained throughout the assets life. Any other related key documents should also be referenced
in the Performance Standard.
PFEER, ACOP 5, Para 58 States:
Setting performance Standards for measures is a crucial aspect of the assessment process. Performance Standards
should relate to the purpose of the system, item of equipment, procedure etc which they describe. They may be
described in terms of functionality, survivability, reliability and availability (FARSI). They should be measurable and
auditable.
Along with interactions with other SCEs, this is commonly known as the FARSI model for Performance Standards
and the following paragraphs provide a brief description and explanation. It should be noted that the examples are
illustrative only and additional criteria may apply to specific SCEs.
Functionality - What is it required to do?
Functionality defines the key duties that the SCE is required to perform. The minimum level at which that function
is achieved must also be defined. Criteria is considered measureable where it is possible for a person carrying out
an assurance activity to clearly understand what the critical requirement is, and to be able to measure or observe
that the criteria is being achieved.
During the operational phase of the installation, the Performance Standard has to reflect how it shall be assured
that the SCE is maintained in the minimum acceptable condition. This may not be the same as the design criteria
- an acceptable level of safe degradation should be defined.
18
For static or passive systems (structures, containment, lifting equipment etc) measureable criteria for operational
suitability may be expressed in terms of the maximum allowable degradation that can be tolerated. This may
derive from international standards, Duty Holders anomaly classification criteria, industry guidelines or other best
practice.
For active systems it is likely that performance can be clearly quantified and confirmed by function test (active
fire system discharge rates, instrument alarm and trip set points, ESD valve closure time and leakage rates etc).
Detailed functional analysis may be required to determine the failure modes (including computer systems) which
lead to loss of critical functionality and the means of identifying them. Equipment that is self-testing may make
functional failure evident.
For SCEs such as personal survival or escape equipment where continual suitability is primarily achieved by original
design specification, it may be more practical to define periodic service or re-certification intervals. Defining a fixed
life for equipment replacement may also be appropriate.
The following example is given only to demonstrate a single Functional criteria:
SCE - UPS
FUNCTIONALITY
FUNCTION
CRITERIA
ASSURANCE REFERENCE
UPS shall maintain power

to the defined emergency
systems.
UPS systems shall provide a back-up

power supply to enable continued
operation of the following emergency
systems in the event of failure of
normal and essential power.
Duty Holder should provide details

of assurance activities or specific
cross references to PMR database
tasks.
The following systems shall have a

minimum duration of XX minutes.
Shutdown Systems
(XX Amperehours)
Fire and Gas
(XX Amperehours)
Emergency related Telecoms
(XX Amperehours)
PA/GA Systems
(XX Amperehours)
Availability - For what proportion of time will the equipment be available to perform on demand? (Alternatively,
the ability for the system to provide access to its resources in a timely manner for a specified duration.)
Availability is concerned with the ability of the SCE to meet its intended function, including its interaction with
other SCEs, eg an electrically driven fire pump can only be deemed available if the power can be provided to the
pump from the emergency switchboard and the pump can deliver the required flow rate to the distribution system.
If any part of the system is defective, it will cause the pump to have reduced Availability. There is often a close
correlation between Reliability and Availability.
19
Availability may be better understood and measureable where it is described in terms of the amount of time
it is tolerable for the critical functions to be unavailable, or to describe mitigation measures that need to be
implemented where Availability is less than 100%.
Availability should be considered during design of an SCE, ie the designer should specify how the system will
manage failure modes and therefore how it will remain available, ie by providing diverse systems and redundancy.
Quantitative risk assessments are often carried out to assist in defining the design requirement. The result of
such a study will produce a target, eg 97.8% availability which equates to an acceptable annual downtime of
approximately 8 days. In theory, this may be a good basis for design, but how shall this remain meaningful during
operations? Is it safe to state that it would be acceptable to continue operation with an essential safety system
out of operation during those days? In practice, it is rarely possible to carry out a meaningful volume of testing to
capture sufficient data to demonstrate that such targets are met.
In general terms, when a system is safety critical, the availability target should be 100%. In practice, the SCE
may never achieve 100% but if (or rather when) an SCE fails in some manner (note the PS should define through
measurable criteria when such a failure occurs), the immediate shortcoming has to be addressed through risk
assessments and through the Safety Management System. The Duty Holder should then aim for improvement, ie
how to prevent similar failures in the future.
Where appropriate measures have been set, it is necessary to ensure that the means to capture required information
are defined in order to assess Availability. This may be through clear recording of failed components, downtime
records and safety critical risk assessments.
The example given below describes the overall goal and the design criteria which have been used to meet this. It
is a requirement to assure / verify that this specification remains available, eg both sides of the public address (PA)
system are being examined for continued effectiveness and Availability of the complete system remains at 100%
(ie failures of individual components may be considered acceptable dependant on the impact on the ability of the
system to operate on demand).
The following example is given to demonstrate possible Availability criteria:
SCE COMMUNICATION SYSTEMS

AVAILABILITY
20
FUNCTION
CRITERIA
ASSURANCE REFERENCE
The PA/GA System shall

maintain 100% Availability.
The PA system has been designed

with built in redundancy.
The PA/GA shall be a dual (subsystems A & B) system, with each
sub-system being capable of
independently providing audible
alarms, visual alarms and speech in all
areas, such that no single failure can
impair both sub-systems. Each subsystem shall be fed from independent
Uninterruptible Power Supplies.
Any failure which affects the ability
of BOTH systems to operate shall be
subject to immediate safety critical
risk assessment and appropriate
mitigating measures implemented.

tasks..
Reliability - How likely is it to perform on demand?

(Alternatively, the ability of an item to perform a required function under given conditions for a specified time
interval.)
Those SCEs for which it is required to measure Reliability during operations should be identified at the design
stage. Reliability targets are set during the design phase based upon safety studies carried out in support of the
Safety Case. These should be measured during the operations phase to confirm compliance.
In operations, a target for Reliability is practical for active systems that need to perform critical functions in
response to a Major Accident (eg Fire & Gas detection, fire pump starting, ESD valve actuation etc). Reliability
targets are also appropriate for systems which actively monitor the status of other systems (eg alarms for loss of
area pressurisation, annulus pressure monitoring, mooring tension, bilge flooding etc). Reliability targets are not
appropriate for passive systems such as structure or passive
fire protection.
Any critical function that has a demand to operate in response to a Major Accident must have a low probability of
failure to meet that demand. The probability must be so low that the risk is considered ALARP.
High Reliability is achieved through the initial design specification of equipment
(ie robust, simple design, self-diagnosis, redundancy etc).
Performance Standard criteria for Reliability can be expressed in terms of Probability of Failure on Demand (PFD),
Safety Integrity Level (SIL) or Mean Time Between Failure (MTBF). The frequency and results of testing must be
such that the Reliability target is confirmed.
During operations, the ability to meet this is demonstrated by functional testing at an appropriate interval. From
these tests, accurate data must be recorded and reviewed in detail to assess if the required Reliability is being
achieved. If the required level of Reliability is not being achieved, appropriate action must then be taken to improve
it. This may include system redesign, amendment of test intervals or revision of the maintenance strategy.
Targets for Reliability in operation may not be possible for some SCEs as there may be no possibility to collect
sufficient data to assure the target is met. In cases such as deluge valves or fire pumps there should be a general
expectation that they shall operate on demand every time. It is vital that Technicians understand this concept and
record when failures are observed during routine testing, ie that the reliability of an SCE is compromised when they
have to carry out corrective maintenance in order for the intended function to complete its action.
21
SCE FIRE & GAS

RELIABILITY
FUNCTION
CRITERIA
ASSURANCE REFERENCE
The entire Fire & Gas system

shall meet defined Reliability.
The Fire & Gas Detection system

design and engineering shall be
carried out and performed to meet
requirements of SIL ratings as defined
within IEC 61508.

tasks..
F&G System processor/controller will

be SIL?
F&G Loops in defined high risk areas
will be SIL?
F&G Loops in defined low risk areas
will be SIL?
(ref to QRA study for target SIL rating)
SCE ESD SYSTEM
RELIABILITY
FUNCTION
CRITERIA
ASSURANCE REFERENCE
ESD Valves for hydrocarbon

risers shall have a probability
of failure on demand less than
xx% (eg 2%).
ESD Valves are designed to

[STANDARD]

tasks..
Testing carried out according to

functional requirements, any failure
to close during testing are reviewed
at the time of test according to SCRA
procedures, appropriate mitigation
measures shall be agreed with TA
within xx time.
Reference to QRA study for target
reliability requirement.
Survivability - How will the system perform post event, eg after fire, explosion, ship impact, dropped objects,
extreme weather etc?
The Performance Standard criteria for Survivability must be defined if the SCE is required to operate in the event of
a Major Accident and should state for how long the system should continue to be effective. Each SCE should be
considered against the MAH defined in the Safety Case. Does the MAH have the possibility to impair the ability of
the SCE to operate? If so, how shall this be mitigated against?
Consider the following examples:
Jacket structures need to be able to withstand ship collision and the highest expected environmental conditions
Module walls need to have fire / blast resistance
The time which structures need to survive the defined fire scenarios
Fire & Gas system shall survive fire scenarios, eg cabling shall be fire resistant, the F&G control system should
be protected by location in the Temporary Refuge
22
Refer to the Prevention SCE Barrier table (Page 30) for other typical SCEs.
Survivability is often determined at the design stage and initial suitability assessment of the equipment (physical
location, fire rating, mechanical strength, fatigue life etc).
The following examples are given to demonstrate possible Survivability criteria:
SCE JACKET STRUCTURE

SURVIVABILITY
EVENT
COMPONENT
CRITERIA
Extreme Weather
All
Reference to structural design report
based on Metocean data for specific
location.
Jacket structures shall withstand

the specified (XXX-year return)
extreme environmental conditions
specified in the site specific
Metocean report without collapse.
Fire and Explosion
Primary structure within X metres of

the YY deck.
Reference to Fire Risk Assessment.
H120 Passive Fire Protection is

applied to structural members in
the defined area.
Interactions - It is useful to define other SCEs which are required to function in order for the one in question to
also operate effectively.
Systems of Safety Critical Elements are often dependent upon each other in order that the MAH is mitigated.
Consider the following examples:
Hydrocarbon containment relies on Structural elements to support the containing equipment and piping
Structural elements rely on Passive Fire Protection to ensure they meet Survivability criteria
Fire & Gas systems rely on Emergency Power (UPS) to ensure they provide protection during power outage or
ESD
Electrical ignition prevention is a system relied upon by others to ensure that safe operation is continued in
potentially flammable atmospheres
The following examples are given to demonstrate potential Interactions:
SCE TEMPORARYREFUGE
INTERACTIONS
SCE
Reason for Interaction / Dependency
Structures
To provide mechanical integrity of the Temporary Refuge. To retain

sufficient integrity to preserve positive pressure following loss of HVAC.
Communications and Alarms
To inform personnel of the need to muster and / or evacuate. To provide

communication facilities with aircraft, shipping (including the Emergency
Response & Rescue Vessel) and external rescue agencies.
Escape and Evacuation Routes
To enable access to and egress from the Temporary Refuge from all areas.
To provide sufficient illumination for personnel to muster in safety, don their
survival equipment and evacuate / escape. To provide sufficient illumination
for persons in command of the emergency to be able to perform their
duties.
23
General Considerations during Setting of Performance Standards

The following considerations should be observed in the setting of Performance Standards:
Each criteria shall be justified:
- it should be encouraged to use and reference design standards and codes where this is relevant
- Safety Case supporting studies such as Fire Risk Analysis (FRA) and Quantitative Risk Analysis (QRA) should
be reflected in the Performance Standards criteria, eg FRA will provide information for the required fire
water demand in respect of the largest potential scenario
Clearly measureable criteria, which can be confirmed during routine operations, maintenance, testing or
inspection, are needed. Where acceptance criteria are obscure or ambiguous they cannot practicably be
assured. This can lead to confusion and loss of confidence in the SCE management process
Lifecycle phases shall be separately considered, but may be combined into a single document
The decision to have single or separate Performance Standard documents for each phase is a matter for
individual Duty Holders, however, it should be noted that the HSE recommend a single document from
cradle to grave. A balance between retaining and making readily available important details of the original
design against providing too much design detail to personnel in the operational phase needs to be made. In
operations, more concise, specific, and measureable criteria are required
Good practice is to align maintenance management activities directly to performance standard criteria,
ensuring that specific failure limits are defined within the routines
The means by which Performance Standard criteria is assured should be identifiable from the Performance
Standard
Review of Performance Standards

Performance Standards should be periodically reviewed. The purpose of this is to:
Incorporate new learnings from within the Duty Holders own organisation, the ICP and other industry
developments
Consider if they are still suitable as required by the Regulations
Increased benefit can be achieved through the use of mixed teams of onshore and
offshore personnel.
Suitability can change over years as new knowledge is obtained and codes and standards also change. The
Duty Holder should ensure that they met these new standards / codes or demonstrate that it is not reasonably
practicable to meet them
Performance Standards should also be reviewed when operating parameters on the installation change, eg
additional wells bringing more hydrocarbons or sour service, higher POB due to additional living quarters etc.
Review of Performance Standards should be carried out in conjunction with the Safety Case thorough review or
when there is a significant change to the asset such that a Safety Case revision is necessary. Examples of such a
change include a significant increase in hydrocarbons production as a result of ongoing field developments or the
addition of production from third parties or additional satellite fields.
Over time, additional criteria may be necessary to address failure modes that may emerge or develop as a result of
the ageing processes which impact on assets in later life.
24
Step Change in Safety - Assurance & Verification Guidance Document
Performance Standards Detailed Example for Operations Phase

SCE TEMPORARY REFUGE (TR)
System Requirements
To provide, for a defined endurance period, a temporary place of refuge for personnel during a major accident
To provide essential life support for sheltering personnel
To provide a safe place of muster
To provide essential command and control facilities for platform management to enable effective emergency response
FUNCTIONALITY
FUNCTION
CRITERIA
ASSURANCE REFERENCE
The TR shall contain adequate space for all

personnel on board to muster.
The primary muster area, located at xx within the

TR is sized suitable for 100% POB (xx persons)
based on xxm2/person + xxm2 for xx stretcher
casualties
Muster area shall be maintained free of
obstructions
Criteria Reference, eg Safety Case, Emergency Escape &
Rescue Analysis, SOLAS Chapter III
This column will be used to define the assurance means

employed by the Duty Holder to assure themselves of the
continued good condition of the particular criteria.
Details of Assurance expectations are addressed later in this
guidance document.
The TR internal boundaries shall provide

adequate integrity against internal fire
events.
Internal boundaries including doors and

penetrations within the TR are fire rated to comply
with SOLAS Chapter II-2 Reg.9
Boundary doors shall be self closing
Air ducts and electrical penetrations shall also be
insulated according to the requirements of above
regulation with certified fire dampers and electrical/
pipe penetrations used
Ref. SOLAS Chapter II-2 Regulation 9
The assurance may be defined by reference to Planned

Maintenance Routines specific to the criteria.
(Please note - It is not intended to define specific assurance
measures within this part of the document)
25

The TR external boundaries shall be
protected against the ingress of harmful
smoke or gas.
Boundary doors are provided with an airlock to maintain positive

pressure of xx bar within TR
Air ducts are provided with fail safe fire dampers to protect against
smoke and gas ingress and maintain the positive pressure within the
TR. Dampers should close within xx seconds of input signal
Fire dampers shall have remote position indication in the emergency
control station
Inspection hatches shall be provided to allow ease of inspection /
maintenance of all boundary fire dampers
Reference, eg Safety Case, Emergency Escape & Rescue Analysis, SOLAS
Chapter II-2 Regulation 9; HSE Offshore Information Note 1/2006
The TR shall support key control and

communications functions for a minimum
duration of one hour.
The TR boundaries shall enclose and effectively protect the following

(examples only):
Emergency Telecoms Room
Main Control Room for critical systems
Emergency Command Centre
Ref: PFEER Regulation 12 & OSCR Schedule 2 & 3
AVAILABILITY
FUNCTION
26
ASSURANCE REFERENCE
CRITERIA
Muster area availability will be 100%
An alternative muster area is provided at location xx to allow personnel at

remote positions a safe alternative
Should either muster area become impaired, this constitutes a failure
of the PS and a Risk Assessment should be carried out and appropriate
mitigating measures implemented
Ref: QRA study
The TR impairment frequency shall not

exceed xx per year.
In practical terms, all functional criteria should be available 100% of time.

Reference QRA study
Ref

RELIABILITY
FUNCTION
Fire Dampers
CRITERIA
Shall have a reliability / ability to operate on demand of xx%

All assurance routine recording should include failures corrected at time
of test
Ref: QRA study & SIL assessment
ASSURANCE REFERENCE
Additional routine may be required here for
review of actual testing records to assess
systems ability to operate on demand
SURVIVABILITY
EVENT
Fire & Explosion
COMPONENT
External boundaries
CRITERIA
Designed and maintained to H120 fire rating and for explosion blast of
0.25 bar overpressure
ASSURANCE REFERENCE
Refer to SCE for Passive Fire Protection for
assurance
INTERACTIONS
Fire & Gas
Protection to F&G System provided by TR, F&G system provides signals to fire dampers to retain integrity of TR
PFP
PFP to provide fire & blast protection for survivability of TR
ESD
ESD system protected by TR
Emergency
Communications
Emergency communications protected by TR
Emergency Power
Emergency power required to provide power to essential TR systems in event of an incident
Guidelines: Criteria to be considered for each SCE

The following tables are provided as a general informative guideline on parameters which may be considered to be defined within FARSI criteria. This is organised into
barrier groupings and listed for each Safety Critical Performance Standard. It is not intended to be a fully developed example set of Performance Standards; merely a list of
parameters which can be defined therein.
27
Prevention SCE Barrier table
28
SCE Example
Functions
Reliability
Availability
Survivability
Interdependence
Example Associated Standards
Process Containment
- Mechanical strength/integrity
- Limits for corrosion, erosion, fatigue, coating
breakdown, mechanical damage, water ingress to
insulation, security of supports etc.
By design - operational target not appropriate as

failure cannot be tolerated.
By design - operational target not

appropriate. To be 100% available in
opertion to avoid loss of containment
- Dropped object resistance/protection

- Blast resisitance
- Pool and jet fire resistance
- Environmental criteria
- Topside Structures to provide support and impact protection

- Deluge or Passive Fire Protection to meet Survivability
criteria
Well Integrity
- Mechanical strength/integrity of wellheads and

Christmas trees
- Internal and external leakage
- Closure time for actuated shutdown valves
- Calibration of annulus gauges
- Condition of wellhead control panel/HPU
- Condition, rating and operation of fusible loop
Identify Safety Integrity Levels (SIL) for operation

of actuated tree valves

appropriate. To be 100% available in
opertion to avoid loss of containment

- Blast resisitance
- ESD System to monitor well status and initiate trip of tree

valves
- Well Examination Scheme
- Fire & Gas to interface with fusible loop
- Deluge systems to meet Survivability criteria
Hull Integrity
- Girder strength
breakdown etc.
- Condition of deck hatches and water/weather
tight doors
- Operation of remote door position indication
- Hull penetration valves - integrity, operation and
position indication (remote and local)
- Cathodic protection systems
Identify Safety Integrity Levels (SIL) for operation

of actuated hull penetration valves

appropriate. To be 100% available to
avoid loss of integrity
- Design strength to withstand ship collision

- Blast resisitance
- Operation of position monitoring systems
following loss of main power
- Ballast system to maintain hull stability

- Inert Gas system to prevent cargo tank over/under pressure
- Navigational Aids to avoid ship/aircraft collision
- Safeguarding Instrumentation to prevent collision during
Shuttle Tanker approach and offloading operations
- Emergency power system to supply position monitoring
system
Jacket and Topside Structures
breakdown etc.
- Structural elevation - Air gap required between
wave crests and the underside of topside structures
- Limits for scour and debris at foundations
- Limits for weight and marine growth


- Design strength to withstand ship collision

- Blast resisitance

- Deluge or Passive Fire Protection to support Survivability
criteria
- ISO 19900 (Offshore Structures - General Requirements)

- ISO 19901-5 (Weight Control)
Lifting Equipment
- Overload protection
- Ropes - security of terminations and discard
criteria

Cranes to be 100% available during

lifting operations
Action on loss of power
Weather limits for crane operations
- API SPEC 2C (Specification for Offshore Pedestal

Mounted Cranes)
- ISO 13535 (Hoisting equipment - Specification)
- ISO 4309 (Cranes Wire Ropes)
- ISO 13534 (Inspection, Maintenance, Repair and
Remanufacture of Hoisting Equipment)
Helideck
- Load limits
- Dimensions (D value)
- Layout and markings
- Identification of permanent obstructions
- Means to prevent temporary obstructions


avoid loss of integrity.
Weather limits for helicopter operations (adverse weather policy)
- Helideck protected from blast overpressure

by location (by design)
- Helideck to resist design scenario helicopter
crash landings.
- The helideck is not expected to remain
usable in scenarios involving the generation
of large amounts of smoke or high levels of
thermal radiation.
- Wave-off/warning beacons to prevent landing during emergency (event escalation)
- Topside Structures to provide support

- Drains systems to handle fuel leaks/spillage
- Active fire protection systems in the event fo helicopter
collision
- Crash box and personal protctive equipment provided to
helideck crew
- Escape routes for access and egress
- Navigational Aids to avoid aircraft collision
- CAP 437 (CAA - Offshore Helicopter Landing

Areas - Guidance on Standards)
- HSE Offshore Helideck Design Guidelines
Mooring System
- Limits for material loss, corrosion, erosion, fatigue, coating breakdown, mechanical damage etc.
- Marine growth limits
- Design limits for tension
- Indication of tension (input to heading control
system)
- Excursion limits and alarms
Safety Integrity Levels (SIL) to be defined for

position and mooring monitoring systems (Test
intervals to ensure SIL level is achieved).

API SPEC 6A - Specification for Wellhead & Xmas

Tree Equipment
API SPEC 2F - Specification for Mooring Chain
Detection SCE Barrier table

SCE Example
Functions
Reliability
Availability
Survivability
Interdependence
Fire & Gas Detection
- Detection methods and types (including MAC)

- Functionality (reference Cause & Effects)
- Set-Points for alarm & trip activation
- Time limits for instrument response
- Failure modes
- Logic Solver voting
- Status Indication (what & where)
- Electromagnetic compatibility
- Safety Integrity Levels (SIL) to be

identified (test intervals to ensure SIL
levels are achieved)
- Overall F&G system availability of XX.X%

- Location and spacing (detectors, MACs)
- Provision of status indication within
Temporary Refuge
- Fault monitoring - provision of alarms on
field detector failure
- Fire rating for field cables

- Ingress Protection (IP) rating for field devices
- Fire detector response time should activate and
initiate executive actions before direct exposure
destroys detector or cabling.
- Operation of loss of main power supplies
- UPS systems supplies Fire & Gas system

on loss of main power
- Ex Certification ensures electrical
equipment si suitable for operation in
hazardous areas
- IEC EN 61508 (Functional Safety of Electronic

Safety-related Systems)
- Energy Institute Model Code of Safe Practice
Part 14 (Inspection and Testing of Protective
Instrumentation)
ESD System (Inputs)
- Process sensor types (manual and automatic)

- Functionality - Set-Points for alarm & trip activation
(reference Cause & Effects)
- Time limits for instrument response
- Instrument response time
- Failure modes
- Operation of ESD timers
- Operation of Blowdown system sequencing logic
- Status Indication (what & where)
- Electromagnetic compatibility

- Overall ESD system availability of XX.X%

- Provision of status indication within
Temporary Refuge

- UPS systems supplies Fire & Gas system

on loss of main power
hazardous areas

Instrumentation)
Safeguarding Instrumentation
- Rotating equipment Over-temperature / vibration

protection
- Lubrication/seal oil status monitoring systems
- Heading contol systems



- UPS systems supplies on loss of main

power
hazardous areas

Instrumentation)
29
Control SCE Barrier table
30
SCE Example
Functions
Reliability
Availability
Survivability
Interdependence
ESD System (Logic Solver

and Outputs)
- Functionality (reference to Cause & Effects)

- Location and diversity of control points
- ESD valve closure time and seat leakage rates
- Failure modes for valve and associated controls

identified (test intervals to ensure SIL levels
are achieved)
- High availability target required for overall ESD

system availability (XX.X%)
- Provision of control functions and status
indication within Temporary Refuge
- Ingress Protection (IP) rating for field

instrumentation
- Fire Safe ESD valves and actuators
- Operation on loss of main power supplies
(duration)
- Fire & Gas Detection initiates ESD on confirmed detection

- UPS provides back-up power supply following loss of main power
- ESD System initiates Blowdown
- Certified electrical equipment ensures field equipment is suitable for use
in a hazardous area
- API Spec 6D (Specification for Pipeline Valves)

- ISO 10497 (Testing of Valves - Fire Type Testing Requirements)
Pressure Relief, Flare and

Blowdown Systems
- System overpressure limits

- Certification of relief valves
- Flare system purge (to prevent air ingress)
- Blowdown rate (pressure vs. time)
- Failure modes for valve and associated controls
- Position/interlock of relief and blowdown system isolation valves

are achieved)
- High availability target required for overall

blowdown system availability (XX.X%)
- Provision of control functions and status
indication within Temporary Refuge
- Fire Safe rating of Relief valves, Blowdown valves

and actuators
- Blast resisitance
- Drains remove flammable liquids from below vessels and rotating

equipment in the event of a leak. This is mitigation against pool fires.
- Liquids from the blowdown/flare system are pumped to the drains
system
- Passive Fire Protection to flare system pipework, vessels and supports
- ISO 23251 (Pressure-relieving and Depressuring Systems)

High Integrity Pressure

Protection Systems
- System overpressure limits

- HIPPS valve closure times

are achieved)
- High availability target required for overall

HIPPS system availability (XX.X%)

- Fire rating of HIPPS valves
- Operation on loss of main power supplies
(duration)
- HIPPS system interacts with ESD to initiate further levels of plant trips
in a hazardous area
Drilling Well Control (BOP,

Mud and Cement)
- BOP closure time

- Condition - External leakage; Visible damage
- Capacity of BOP accumulator System (number of operations)
- Capacity of mud / cement systems
- Location and diversity of control points
- Testing regime in accordance with API

RP 53 (Recommended Practice for Blowout
Prevention Equipment Systems for Drilling
Wells)
- BOP system to be available at all times when

drilling
- Dropped object protection/resistance

- BOP control hoses to be certified fire resistant
(duration)
- UPS power provided to control consoles in the event of loss of main

power
- HVAC required for the mud/cement systems to operate (safe area
pressurisation)
in a hazardous area
- Well Examination Scheme to confirm design of pressure envelope
- API RP 53 (Blowout Prevention Equipment Systems for Drilling

Wells)
- API Spec 16D (Control Systems for Drilling Well Control Equipment
and Control Systems for Diverter Equipment)
- ISO 13533 (Drill-through Equipment (BOPs))
Ventilation and HVAC
- HVAC air change rates (open areas, turbine compartments)

- Location of inlets/outlets (relative to haz. areas)
- HVAC Fan and damper status indication (what & where)
- Operation of instrumentation to monitor area pressurisation / flow rates
- HVAC damper operation, closure time and position indication
- HVAC dampers on the Temporary Refuge

boundary should meet SIL 2 (PFD of 10-2
to 10-3)
identified for dampers on other areas
and instrumentation that monitors HVAC
operation (pressurisation and flow alarms,
interlocks etc.)
- Availability of Temporary Refuge HVAC system

to match TR Impairment Frequency (TRIF) .
- TR boundary dampers to have sufficient fire rating/

blast protection to meet endurance period
- Fire & Gas detection controls fans and dampers. Isolates non-certified
electrical equipment on loss of pressurisation
- HVAC provides pressurised atmosphere within Temporary Refuge
in a hazardous area
- ISO 15138 (HVAC)

- HSE Offshore Information Sheet No 1/2006
- Energy Institute Model Code Part 15 Area Classification Code for
Installations Handling Flammable Fluids (IP15)
Drains
- Limits for corrosion, erosion, fatigue, coating breakdown, mechanical damage,
water ingress to insulation, security of supports etc.
- Sizing
- Segregation (e.g. open/closed systems)
- Bunded areas unobstructed and clear of debris

identified for drains tank level controls and
indication (test intervals to ensure SIL levels
are achieved)
- Availability target should align with target

production efficiency for plant

- Blast resisitance
- Segregation (e.g. between fire zones)
- Drains remove flammable liquids from below vessels and rotating

equipment in the event of a leak. This is mitigation against pool fires.
- Liquids from the blowdown/flare system are pumped to the drains
system
- UPS provides power to drain pumps and instrumentation following loss
of main power
in a hazardous area
Ballast Systems
- Pump sizing and performance

- Corrosion protection/resistance
- Ballast tank level control
- Operation and accuracy of loading computer
- Failure mode (valves)
- Remote tank level indication
- Tank internal coatings and corrosion resistance
- Cathodic protection systems

identified for ballast tank level controls and
indication (test intervals to ensure SIL levels
are achieved)
- Availability target should align with target

production efficiency for plant
- Arrangements for alternative (back-up) loading
computer
- Provision of ballast system isolation to allow

system operation following collision damage
- Hull provides secondary containment for liquid product. Isolates liquid

product in the event of breach.
- Emergency power to operate ballast pumps following loss of main
power
Marine Inert Gas Systems
- Sizing
- Failure mode (valves)
- Control of inert gas generation (O2 content)
- Pressure/Vacuum breaker location/functionality
- Pressure/Vacuum breaker liquid levels and glycol content
- Flame arrestors
- Safety Integrity Levels (SIL) to be identified

for failure of IG supply/quality to trip (test
intervals to ensure SIL levels are achieved)
- Inert Gas supply required during offload

operations
- Supply rate to be in excess of offloading rate
- Not ikely to be required in MAH scenario

in a hazardous area
Dynamic Positioning/
Heading Control System
- Maximum excursion
- Monitoring and alarms (turret position, off-station, mooring tension etc.)
- Manual and automatic operation of thrusters
- Operation and condition of thrusters
- Condition of hydraulic supplies to thrusters
- Position/heading reference data (gyro compass/GPS etc.)
- Condition/operation of turret bearing (including hydraulic systems)

for system (test intervals to ensure SIL levels
are achieved)
- Emergency power supplies ensure system

availablility following loss of main power supplies
- UPS provides emergency power following loss of main supply

- Provides protection to and monitoring of Mooring System integrity
Ignition Prevention
- Selection and condition of Ex certified electrical equipment

- Sizing, condition and continuity of anti-static devices, grounding and bonding
- Location and condition of insulation to limit surface temperatures
- Condition and security of spark and flame arrestors
- Sample sizes for Ex equipment

inspections to be reviewed in accordance
with IEC 60079-17
- Ignition prevention functionality to be available

while electrical equipment in hazardous areas
is energised. Power supplies to be isolated in
non-hazardous areas on confirmed gas detection
or loss of pressurisation
- Ex Electrical Equipment is not required to survive

a fire or explosion in the area where ignition will
already have occurred.
- HVAC maintains safe areas by pressurisation and limits flammable gas

accumulations within hazardous area atmospheres
- Fire & Gas system isolates non-certified electrical equipment in the
event of gas detection / loss of pressurisation
- ISO 19901-6 (Marine Operations)
- IEC 60079-14 (Electrical Installations Design Selection and

Erection)
- IEC 60079-17 (Electrical Installations Inspection and Maintenance)
Mitigation SCE Barrier table
SCE Example
Functions
Reliability
Availability
Survivability
Interdependence
Fire Water Pumps
- Methods and operation of manual and automatic initiators

- Operation of firepump starting systems (electric, mechanical, pneumatic
etc.)
- Remote status indication
- Operation of firepump starting logic (duty, stand-by etc.)
- Condition of drive (diesel) engine and ancilliaries (fuel, coolant,
ventilation etc.)
- Operation of diesel engine protection (overspeed, low lube oil etc.)
- Pump delivery performance (flow rate, delivery pressure)
- Pump diversity to meet demand

- Diverse starting methods
- Safety Integrity Levels (SIL) to be identified for
fire pump starting (test intervals to ensure SIL
- Sufficient water supply to meet demand

scenarios identified in fire risk analysis
- Number of pumps required to achieve
demand
- Diversity of supply (duty/standby) pumps
provided
- Sufficient quantity of fuel to meet X hours
operation

- Blast resisitance
- Fire rating for control cables
- Operation of start system on loss of main
power supplies (duration/number of diesel
engine starts)
- UPS supply to fire pump starting and control systems

- Certified electrical equipment and diesel engine exhaust
lagging ensure equipment is suitable for use in a hazardous
area
- Fire & Gas detection system provides automatic initiation
and status indication
- Passive Fire Protection system to protect area where fire
pumps are located
- NFPA20 (Standard for the

Installation of Stationary Pumps for Fire
Protection)
Fire Water
Distribution and
Monitors
- Condition of ring main pipework and supports

- Operation of ring main isolation valves
- Condition of monitors
- Operation of monitor oscillation and locking devices
- Monitor Spray patterms
- Operation of interface with cooling water systems (actuated crossover
valves)
- Ringmain pressure monitoring (to initiate fire/jockey pump)
- By design: Operational target not appropriate

cooling system crossover valve operation and
firemain pressure monitoring instrumentation
(test intervals to ensure SIL levels are achieved)

scenarios identified in fire risk analysis required
- Pressure monitoring and jockey/fire pump
ensures firemain is capable of supplying
demand promptly
- High availability target required
- Significant reduction in risk of fire or
hydrocarbon release (plant shutdown) required
in the event of unavailability
- Isolation valves on the firemain allow

damaged sections to be isolated in MAH
- Fire Pumps to supply firewater

- Manual firefighting equipment provides hoses and branches
for hydrant operation
- Passive Fire Protection system to protect vulnerable areas of
firemain pipework
- Fire & Gas detection system to initiate operation of
monitors and indicate activiation
- NFPA15 (Standard for Water Spray

Fixed Systems for Fire Protection)
Deluge and Foam

Systems
- Operation of manual and automatic initiators

- Deluge valve failure mode
- Reaction time to water delivery
- Spray patterms (blocked nozzles)
- Flow rate and delivery pressure (at most hydraulically remote nozzle)
- Coverage (areas, flow rate, fluid density)
- Cleanliness of foam proportioners
- Quality of stored and produced foam (% concentration)
- Condition of foam storage tanks and distribution pipework

deluge valve operation (test intervals to ensure SIL
- Shelf life of foam concentrates

scenarios identified in fire risk analysis required
- Significant reduction in risk of fire or
hydrocarbon release (plant shutdown) required
in the event of unavailability
- Isolation valves on the firemain allow

damaged sections to be isolated in MAH
- Deluge valves located outside protected
areas
- Fire Pumps and Firewater distribution system (ringmain) to

supply firewater
- Fire & Gas detection system to initiate operation of deluge
and indicate activiation
- NFPA11 (Standard for Low Medium

and High Expansion Foam)
- NFPA15 (Standard for Water Spray
Fixed Systems for Fire Protection)
Helideck
Firefighting
Equipment

- Quality of stored and produced foam (% concentration)
- Reaction time to foam delivery
- Operation of foam monitor oscillation
- Duration of foam supply
- Effective helideck coverage and throw

for foam monitor activation and oscillation (test
intervals to ensure SIL levels are achieved)
- Shelf life of foam concentrates
- By Design: Sufficient monitors to be installed

to ensure an effective application of foam to
any part of the landing area irrespective of the
wind strength/direction or accident location
- Adverse Weather policy for helicopter
operations
- Minimum application rates to be availalbe
during helicopter operations
- Helideck to be manned by at least X persons,
including the HLO, during helicopter operations
- By Design: Foam tanks and distribution

pipework protected by location
- Winterisation and environmental protection
- Process Containment to prevent loss of helifuel

- Drains to ensure liquid does not pool in helideck area and
helifuel bund is available
- Fire Pumps and Firewater distribution system (ringmain) to
supply firewater
- Fire & Gas detection system to indicate activiation of
monitors
- Emergency Communications to allow asset to communicate
with aircraft/ERRV and warn aircraft not to land in the event
of coincident emergency on installation
- Manual firefighting to provide portable extinguishers to
supplement fixed system
- Personal Protective Equipment to provide suitable PPE to
helideck crews
CAP 437 (CAA - Offshore Helicopter

Landing Areas - Guidance on
Standards)
Gaseous Fiire
Protection Systems

- Condition and rating of fusible loops
- Operation of firing system (faulire modes)
- Duration and concentration level of suppressant required in protected
space
- Pre-release warning alarms, time delays and warning signage
- Sufficient quantity of suppressant
- Retention of extinguishant in protected area (damper, bulkhead
penetrations, turbine compartment etc.)
- Condition and cleanliness of discharge nozzles

system activation device (test intervals to ensure
SIL levels are achieved)
- Quantities of suppressent required to achieve

required concentraction level
- Condition of protecetd space boundaries
(doors, bulkhead penetrations, turbine
enclosure etc.) to retain suppressant
- Operation of ventilation dampers at
boundary of protecetd space
- Location of suppressant storage outside

protecetd space
- Fire & Gas detection system to initiate suppressant and

indicate activiation
- HVAC to operate boundary dampers on demand and
monitor pressurisation of protected area (remote alarm if
doors left open)
NFPA12 (Standard on Carbon Dioxide

Extinguishing Systems)
Sprinkler Systems

- Frangible bulb condition and temperature rating
- Minimum delivery pressure and Flow rate

flow and pressure monitoring instrumentation
(test intervals to ensure SIL levels are achieved)
- By design - No survivalbility criteria for

ongoing suitability
- Fire & Gas detection system to initiate sprinkler and indicate

activiation
- Fire Pumps and Firewater distribution system to supply
firewater
NFPA13 (Standard for the Installation

of Sprinkler Systems)
Manual Firefighting
Equipment
- Operability of Hydrants
- Condition and availability of valve couplings
- Quantity, condition and location of hoses
- Condition and availability of in-line pressure regulating device
- Quantity and location of wheeled and portable extinguishers
- Certification of wheeled and portable extinguishers
- No specific reliability target for this Safety

Critical Element (SCE)
- Manual firefighting equipment to be provided

ready for immediate use at their designated
location (Safety Equipment Layout drawings)
- By design - No survivalbility criteria for

ongoing suitability
- Fire Pumps and Firewater Distribution to supply firewater

- Personal Survival Equipment to provide appropriate PPE for
emergency response team personnel
Passive Fire
Protection (PFP)
- Protected areas
- Limits of degradation - bonding breakdown, exposed areas, coat-back
on attachments to protected areas
- Vent paths adjacent to blast walls unobstructed
- Fitment of PFP jackets on (riser) ESD valves

- PFP to be available at all times during normal

operations
- Design criteria (fire suitable rating) for

survival time of protected areas
- Limits for blast overpressures (X mBar)
- Primary structures that require protection
API Publication 2218 (Fireproofing

Practices in Petroleum and
Petrochemical Processing Plants)
31
Emergency Response SCE Barrier table
32
SCE Example
Functions
Reliability
Availability
Survivability
Interdependence
Temporary
Refuge (TR)
- Space for entire POB to muster

- Condition of boundary doors and seals
- Condition of other bulkhead penetrations
- TR leakage rate - Integrity of enclosure to retain positive pressure for
survivival period (may be expressed in air-changes per hour)
- Number of air-changes during normal operations ()
- Pressurisation during normal operations ()
- Location of inlets/outlets (relative to haz. areas)
- HVAC Fan and damper status indication (what & where)
- Operation of instrumentation to monitor area pressurisation / flow rates
- HVAC damper operation, closure time and position indication
- High reliability target for HVAC dampers on

the TR boundary (SIL 2)
- High reliability target for instrumentation
that monitors HVAC operation (pressurisation
and flow alarms, interlocks etc.)
- Availability target for Temporary

Refuge to match TR Impairment
Frequency (TRIF)
- TR to prevent an ingress of flammable gas ro

smoke (i.e. retain a positive pressurisation) for a
period of X minutes.
- TR to survive all hydrocarbon oil fires for a
period of X minutes (by design)
- TR to survive blast overpressure of X mbar
(by design)
- Provision of battery-backed emergency
lighting in muster and command & control
areas (duration)
- Topside Structures provide support and survivability for the TR

- HVAC systems (initially) provide a safe, breathable atmosphere with the TR
- Passive Fire Protection protect the TR from the effects of fire and explosion
- Active fire protection systems provide emergency command and control facilities through provision of manual firewater pump
start and remote release facilities for deluge and extinguishant systems within the TR
- ESD System provide emergency process control and shutdown initiation facilities within the TR
- Fire & Gas Detection monitors presence of fire or potentially flammable atmospheres that could impair the TR
- UPS and emergency generator provide emergency power to command and control systems within the TR
- Emergency Communications inform personnel of the need to muster and/or evacuate
- Emergency Communications provide communication facilities with aircraft, shipping (including the Emergency Response &
Rescue Vessel) and external rescue agencies
- Personal Survival Equipment provides personnel in the TR with protective equipment
- Escape Routes enable access to and egress from the TR from all areas and provide illumination of escape routes, muster
areas and emergency command and control centres
- Ballast / Mooring / Dynamic Positioning / Heading Control systems provide vessel stability and attitude control
Escape Routes
- Dimensions
- Visibility and limits for degredation of markings
- Condition of non-slip surfaces
- Obstructions on walkways and access/egress points
- Obstructions in evacuation and escape embarkation areas
- Obstructions affecting access to emergency response or escape equipment
- Condition and closure of doors at pressurised areas/air-locks
- Intensity of escape lighting
- Signage at changes of direction
- By design: operational target not

appropriate
- Duration of escape lighting (escape

routes, muster and embarkation areas)
- Diversity (number fo egress routes)
- Blast resisitance
- Provision of battery-backed emergency
lighting to mitigate effects of smoke (duration)
- Topside Structures to provide adequate support and aid survivability of escape routes
- Passive Fire Protection to protect escape routes from the effects of fire/explosion
- Personal Survival Equipment to provide equipment to assist personnel to escape to a place of safety
- Emergency Communications to control alert personnel of the need to muster and advise routes/areas to avoid
- ISO 15138 (HVAC)

- HSE Offshore Information Sheet No
1/2006
- Energy Institute Model Code Part 15
Area Classification Code for Installations
Handling Flammable Fluids (IP15)
TEMPSC
- Condition of canopy, hull/stern glands, doors and seals

- Condition and (fixed time) replacement of fall wires
- Davit load test certification
- Condition of davits and deck connections (NDT examination)
- Operation of winch brakes and release mechanism
- Descent rate (laden or unladen)
- Engine starting (via diverse systems)
- Operation of clutch and steering
- Security and condition of harnesses
- Operation of interior lighting
- Fuel tank level and quality (water contamination)
- Status of batteries and charging systems (fixed time battery replacement)
- Pressurisation air (charge pressure and bottle certification)
- Operation of radio communication (with CCR, Radio Room, Stand-by vessel)
- Deluge system coverage
- Operation of hydrostatic and on-load release gear (maintenance pendants
to be fitted)
- Operation (self-test) of emergency location beacon (EPIRB/SART)
- High reliability target for launch readiness

(engine starting etc.)
- High reliability target for release gear (fail to
release and fail open ) to be considered
- HSE guidance identifies 150% design

capacity
- Sufficient capacity to enable all
persons to evacuate to a place of safety
to be provided at all times
- High target required for TEMPSC
availability (e.g. 98% = 7 days downtime
per year for maintenance and testing).
- Location of TEMPSC allows
embarkation from Temporary Refuge
- Size of embarkation areas and
illumination by battery-backed escape
lighting
- Provision for persons who cannot
access the TR in MAH
- Independent air system allows use in smoke

filled or toxic atmospheres
- Deluge system provide protection from
radiated heat
- TEMPSC protected from explosion
overpressures by location (by design)
- Topside Structures to support lifeboat davits

- Emergency Communications provides an electronic location beacon and voice communication with CCR/radio room/stand-by
vessel
- Heading Control System to provide a sheltered (lee) area for the TEMPSC to launch from floating installations.
- Ballast System prevents heel or trim angles which could prevent TEMPSC launch from floating installations
- Tertiary Escape Systems provide alternative means of escape in the event of TEMPSC unavailability
- Escape Routes to ensure that embarkation areas are unobstructed and adequately illuminated
- Emergency Response and Recovery (Stand-by) Vessel provides a place of safety
- International Life-Saving Appliance

(LSA) Code
- SOLAS Chapter III
- HSE Offshore Information Sheet
Number 10/2007 (Testing of TEMPSC
Release Gear)
- HSE Approved Code of Practice and
guidance for PFEER Regulations (ISBN
978 0 7176 1386 1)
Number 12/2008 (Big persons in
lifeboats)
Personal Survival
Equipment
- Location and quantities (relative to POB)

- Cabin grab bag contents
- Inspection/Recertification date (SOLAS/LSA Code requirements)
- Condition and accessibility of storage cabinets
- Defined life replacement
- Design/construction standard of equipment
- Capacity of breathing apparatus
- Tools and PPE for Emergency Response Team and Helideck crews
- By design: operational target not

appropriate
- Location of equipment (relative to

muster + other areas)
- Provision within the Temporary Refuge
- Location of equipment (fire/blast protection)

- Equipment design rating
- Emergency Response and Recovery (Stand-by) Vessel provides a place of safety and facilities to rescue evacuees from the
sea

(LSA) Code
- SOLAS Chapter III
Number 7/2009 (Lifejackets for
abandonment from an offshore
installation)
- HSE Offshore Technology Report OTO
95 038 (Review of Probable Survival
Times for Immersion in the North Sea)
Tertiary Escape
Systems
- Location and quantities (relative to POB)

- Design/construction standard of equipment
- Inspection/Recertification date (SOLAS/LSA Code requirements)
- Condition and accessibility of storage cabinets
- Defined life replacement
- Operation of winch brakes and release mechanism
- Davit load test certification
- Condition of davits and deck connections (NDT examination)
- Condition and (fixed time) replacement of fall wires (liferafts)
- Condition and certification of descent device anchor points
- Condition of escape to sea ladders
By Design: Equipment
Designed/constructed to SOLAS/LSA Code
standards
- Location of equipment (relative to

muster + other areas)
- Provision within the Temporary Refuge
- Location of equipment (fire/blast protection)

- Equipment design rating
- Temporary Refuge provides a safe environment to collect and don personal survival equipment
- Structural integrity ensures escape to sea ladders remain suitable and provides support to davits
- Escape Routes enable access to personal survival equipment
- Emergency Response and Recovery (Stand-by) Vessel provides a place of safety and facilities to rescue evacuees from the
sea

(LSA) Code
- SOLAS Chapter III
SCE Example
Functions
Reliability
Availability
Survivability
Interdependence
Emergency
Communications
- Audible alarm type (ref. PFEER Reg. 11)

- Audible alarm volume
- Visual alarm in high noise areas
- Access points
- PA amplifier fault monitoring
- Operation of alternative (internal) communications (hot-line telephone,
intercom, manual alarm call point, UHF radio etc.)
- Quantities and location of radios for Emergency Response Team
- Operation of CCTV systems
- Operation of alternative (external) communications (GMDSS, air band radio,
satellite telephone, etc.)
- TEMPSC communications (VHF radio, EPIRB etc.)
- High Mean Time Between Failure (MTBF)

required for central and field equipment
- By design: PA systems duplicated so

that no equipment part is common to
the two systems (excluding the access
panels)
- High availability target required for
all emergency communications systems
(XX.X%)
- Diversity of PA/GA systems

(duration)
- Equipment located in protected area
(Temporary Refuge)
- Fire & Gas detection system to automatically activate emergency alarms and provide manual alarm call points
- UPS provides back-up power supply following loss of main power
- Emergency Response and Recovery (Stand-by) Vessel provides alternative / relay communications facilities in an emergency
Helicopter
Facilities
- Condition of markings (perimeter line, landing circle, H etc.)

- Condition and security (windsock, tyre blocks, rotor tie-down points,
perimeter and landing net)
- Condition of high friction surface
- Area free from debris
- Condition and illumination of installation location signage
- Availability of portable fire extinguishers
- Operation of Non Directional Beacon (NDB)
- Operation of perimeter and flood lighting (including louvers and dimmers)
- Crash box contents
- Condition of refueling system (including drains, bunds and earth bonding
equipment)

- Helideck is only considered operational

if active fire protection systems are
functional
- Helideck protected from blast overpressure by

location (by design)
- Helideck to resist design scenario helicopter
crash landings.
- The helideck is not expected to remain usable
in scenarios involving the generation of large
amounts of smoke or high levels of thermal
radiation.
- Environmental criteria (adverse weather
policy)
- Emergency beacons prevent landing during
emergency (event escalation)
- Helideck Firefighting Equipment to mitigate the effects of helicopter collision

- Topside Structures provide support to helideck
- Fire & Gas Detection initiates helideck flashing beacons in the event of an emergency onboard the installation
- Drains collect and remove rainwater or other liquids from the helideck
- Emergency Communications provide two-way radio communication between installation and aircraft
- Personal Survival Equipement provide suitable protective clothing for the helideck crew
- ERRV provides close support during helicopter operations
- Ballast / Mooring / Dynamic Positioning / Heading Control systems provide vessel stability and attitude control during
helicopter operations
- CAP 437 (CAA - Offshore Helicopter

Landing Areas - Guidance on Standards)
- HSE Offshore Helideck Design
Guidelines
Emergency
Response and
Rescue Vessel
(ERRV)
- Vessel capacity (100% POB + helicopter crew and full passenger

complement)
- Vessel specification (Survivor Class)
- Control of operations (helicopter ops, over-side working, adverse weather
policy, man over-board drills etc.)
- Sea Rescue Capability (daughter and fast rescue craft, semi-rigid and
manoeuvrable rescue net (Dacon Scoop), scramble nets etc)
- Medical facilities
- Radar monitoring of safety zone
- Communications facilities
- Recovery and Rescue capabilities (time to rescue surviviors in the event of
falling overboard, helicopter ditching, escape from installation etc.)

- ERRV to be on location at all times

and be positioned, such that she can
best achieve Performance Standard.
- Vessel to remain within the
designated patrol area at all times,
excluding exceptional weather
conditions.
- ERRV Master to ensure that the
OIMs, are kept updated of changing
circumstances which could affect the
ability of their Vessel to respond
- If Vessel has to depart location for
any reason, the Master is to inform OIM
of intended activity and ETA back on
location. - OIM can then decide on any
contingency arrangements required
- Vessels recovery and rescue capabilities will

be severely restricted in extreme weather
- Adverse weather policy

- Navigational Aids help to prevetn vessel collision
- Emergency Communications provide radio communications between installation and ERRV
- ERRV can assist in maintaining desired heading floating installations lose heading control / Dynamic Positioning / mooring
integrity
- Oil & Gas UK Emergency Response and

Rescue Vessel Management Guidelines
- Oil & Gas UK Emergency Response and
Rescue Vessel Survey Guidelines
- HSE Offshore Technology Report OTO
95 038 (Review of Probable Survival
Times for Immersion in the North Sea)
33
6. ASSURANCE AND INTEGRITY MANAGEMENT
Introduction
The purpose of Assurance and Integrity Management is to demonstrate that the required level of Availability and
Reliability of plant, equipment and systems is achieved in order for them to perform their required functions when
required to do so. This includes the definition of essential requirements of SCE Management Systems (including
performance metrics and data quality standards), to allow measurement, management, monitoring, and analysis
of maintenance data to enable the optimisation of maintenance.
Furthermore, the OSCR requires that the Duty Holder ensures that an installation, at all times, possesses such
integrity as is reasonably practicable.
Good business practice and Legislation drives Duty Holders to ensure assets have in place documented, robust
Assurance Management processes to ensure the safe operation of the asset throughout its operational lifecycle,
taking into account equipment obsolescence, natural deterioration and the effects of ageing.
Assurance Process
The Assurance processes to achieve safe and effective operations normally encompass a cyclic form of continuous
improvement which is well documented with the HSEs guidance document HSG 65, Successful health and safety
management.
This is often referred to as a PLAN / DO / CHECK / ACT approach which forms the framework for a widely
recognised Integrity Management System. More detail on this process can be found in the Step Change Asset
Integrity Toolkit but forms the framework of the remaining guidance in this section.
Integrity Management Systems
Plan
Act
Inspect
Maintain
Test
SCEs
Performance
Standards
Do
Check
Assurance of Management of MAH

To effectively assure the management of risks from Major Accident Hazards (MAH), the Duty Holder needs to
define a clear process for the MAH and SCEs identified (and described in earlier sections of this document).
34
Document an inventory of existing plant and equipment with safety or business criticality.
Identifying / understanding the degradation and failure mechanisms for specified equipment,
materials and designs.
Consider obsolescence of equipment.
PLAN
Specify and apply appropriate maintenance activities and frequencies to deal with expected
degradation to assure reliable performance.
Specify and apply appropriate inspection and testing regimes to provide early detection of
impaired performance and to assure maintenance activities are achieving their intent.
Implement a robust deferral and deviation processes.
Carry out defined assurance activities and Record results

DO
Carry out corrective measures for degraded performance and/ or temporary mitigating
measures
Assess occurrences of degraded performance

CHECK
ACT
Monitor integrity compliance through suitable management reports and KPIs, eg SCE backlog
Consider knowledge gained through this process and implement changes where necessary to;
effectiveness of defined assurance routines
effectiveness of performance standard criteria
design of equipment or plant
Assurance applies to all plant and equipment on an installation, and proactive strategies should be employed to
avoid critical unplanned failures, particularly during the operational phase, which can lead to business interruption
and accidents. The following example outlines one process plant system and illustrates the challenges which may
be faced in an organisation where Assurance and Integrity Management is not effective.
A produced water line has been assessed as production and safety critical due to potential for oil and gas carryover into the line and a need to assure that it will reliably retain fluids over the intended lifetime and avoid any
unplanned hazardous discharges. External and internal corrosion of the line is predicted from a risk assessment,
with the latter considered to be the dominant failure mechanism. Periodic wall thickness checks are carried out in
defined locations to ensure maintained integrity and to monitor and record the actual condition. A trend of wall
thickness reduction is observed over time and a predicted line replacement date is set. After a further period of
time, areas in the line with branches of stagnant produced water (dead legs) are monitored and found to have
rapid localised corrosion. These are eliminated by removal and re-design. The knowledge gained is used to review
other piping systems for similar problems and any remediation necessary.
35
As further time progresses, some areas show higher levels of loss of wall thickness than the general trend. A review
is carried out to establish what action to take. According to the remaining business needs of the process system, it
is established whether the piping system must be replaced entirely, partial replacement using new piping spools, or
local permanent repair patches or clamps are installed. A new inspection plan is developed to monitor the revised
arrangements based on the condition and expected degradation and risks.
A good Assurance process proactively addresses degradation to ensure that plant and equipment condition is
known at all times through its operational life and appropriate actions are taken in advance of failures. This is well
stated in the HSEs Research Report RR509 (Plant Ageing: Management of equipment containing hazardous fluids
or pressure) as: Ageing is not about how old your equipment is; its about what you know about its
condition, and how thats changing over time
Key Aspects to Consider when Planning Assurance Strategies

An assurance or maintenance strategy should be result-oriented with a product of improved equipment reliability,
productivity and asset preservation, delivered through Maintenance Services in co-operation with Production. The
desired results should be defined along with measurements of target improvement in areas such as:
Preserve technical integrity
Increase production and operating efficiency
Minimise scheduled downtime and unscheduled downtime
Lower unit operating costs
Optimise maintenance costs and eliminate waste
The strategy should define critical spares requirements and the key maintenance support contract services. Supply
chain processes which support the asset maintenance management. Strategies should be reviewed on a suitable
frequency to ensure that they remain aligned to the asset business objectives.
Maintenance Routines
Maintenance routines are a set of instructions to carry out specific activities on plant and equipment to ensure they
continue to remain suitable and function as intended.
Maintenance routines, including inspection, are developed for all equipment and entered into the Maintenance
Management System (MMS), before the equipment is brought into service and are scheduled to be implemented
at specific frequencies in accordance with the maintenance strategies.
Maintenance work is selected on the basis of criticality and risk. The tools and processes applied for work selection
are based on availability and reliability requirements and the complexity and lifecycle of the facility.
Equipment reliability and availability requirements should be defined in the SCE Performance Standards, and the
associated maintenance requirements should be scheduled with the aim of providing sufficient evidence to show
compliance with these requirements.
36
Key Aspects to Consider when Doing Assurance

Maintenance Records
Records of activities should be readily available to demonstrate compliance with asset, company and legal
requirements. The MMS should form the data depository and primary source of information, history and records
for all Maintenance and Reliability activities throughout the lifecycle of the Asset.
All necessary information; including expended Technician time, equipment condition, resources used, failure /
damage codes and inspection records / certification is normally recorded in the MMS at the end of each day and /
or after the work is completed, and this is a valuable source of information for analysis.
A formal change management system should be in place, controlling changes and updates to the MMS structure,
equipment or planned maintenance activities.
SCEs and specified plant should be identified in the MMS and the status of maintenance work performed should
be monitored and reported. SCE Performance Standard requirements should be communicated through the MMS
and identified in maintenance records.
The MMS should have a standard suite of reports which provide relevant, high quality and accurate information to
allow monitoring of compliance, critical to ensuring the effectiveness and efficiency of scheduling, execution and
supporting activities for Maintenance and Reliability.
Procedures should be in place to manage the deferment of planned and corrective maintenance and inspections.
As Found / As Left Status

When testing a SCE, it is critical that the test is performed without assisting compliance in any manner. In this
way, it can be determined whether it would have performed on demand. It is also important that the as found
status of the equipment is reported as this will help determine the Reliability and Availability of the equipment.
This information is key to ensuring the right type of maintenance / testing is in place at the correct frequency, thus
increasing confidence that the SCEs will work on demand.
Additionally, it is important to record the as left condition, so that site personnel know the status of the SCE. This
could be fully operational or still requiring remedial work. If requiring remedial work, a risk assessment should be
conducted to ascertain if any mitigation measures can be implemented to continue operations until the full repair
is conducted.
This information should be recorded within the MMS for future analysis / auditing.
Repairs
A procedure should be in place to address all repairs (including temporary repairs) to components / systems where
failures occur. The failure should be risk-assessed to determine the impact upon the system / plant or equipment
involved and its suitability to continue in operation.
The process should address the quality of repairs to plant and equipment to ensure the original design integrity or
Original Equipment Manufacturer (OEM) requirements are maintained. Any deviation should be formally reviewed
and approved before it is implemented.
Repairs should be approved by the appropriate Technical Authority where the system is deemed safety critical,
before they are implemented.
37
Corrective Maintenance and Priorities

Corrective work orders should be raised within the MMS for repairs to failed plant or equipment. These should be
approved, and prioritised by Production and Maintenance supervision using a systematic and consistent risk-based
approach to balance operational threats, business constraints and the need for effective planning and scheduling.
Key Aspects to Consider when Checking Assurance Results

Monitoring Quality of Maintenance
Quality Assurance checks should be specified and carried out by competent personnel.
All work on safety critical equipment should be managed, documented, verified complete and closed out to a
suitably approved standard.
Supervisors should review work orders for completeness and check and confirm the integrity and quality of the
information recorded in the MMS.
Availability / Reliability Analysis

Asset-specific maintenance strategies select and define the maintenance methodology most appropriate to
preserving and protecting the facility and for achieving asset lifecycle objectives for safety, technical integrity,
reliability and plant availability, and for optimising the maintenance effort and costs.
Regular analysis of maintenance records and plant operational data should take place to confirm maintenance
strategies are delivering expected outcomes.
Management of Specialist Contractors

Specialist contractors are third parties working on behalf of the Duty Holder performing activities that directly and
indirectly affect the integrity of equipment. The operational interfaces with contractors / third parties should be
identified, assessed, fully understood and appropriately managed.
A process should be in place to ensure third party services are evaluated to establish conformance with needs, and
effective interfaces with contractor management should be in place.
Third party personnel should be assessed for their competence and capability to perform the work in a manner
consistent with the Duty Holders standards.
On completion of the work activity, and before leaving the site, the contractor should provide the Asset Discipline
Supervisor with a draft written report on the status of the work completed, including recommendations and
required follow-on actions, and areas of concern.
The Asset Discipline Supervisor should ensure that equipment / systems are safely reinstated and the appropriate
records / MMS are updated with the work status and findings.
Regular meetings should be held to review the status of the maintenance, where a typical agenda could include
the following:
Review past weeks performance
Review additional work completed
Review outstanding work
Review key learnings
Validate and optimise upcoming maintenance window
Review logistical requirements
Review emerging work
Review any threats to the plan.
Daily meetings should be held to review completed scheduled work for that day, new corrective work, work order
data quality and work scheduled for the next day. These meetings will ensure adherence with the work schedule
and control break-ins required as a result of arising operational constraints.
38
Cumulative Risk
The Duty Holder needs to assess the effect of cumulative risk of impairments and failures on SCEs across all areas
of plant, equipment and systems to ensure that MAHs remain adequately controlled to acceptable levels.
This is an important concept and refers back to the proposal at the start of this document that MAH seldom occur
as the result of a single failure. Industry best practice has developed tools in recent years which gather data from
several sources from the platform systems in order to analyse the Cumulative Risk.
Audit
Audits of activities defined, performed and recorded under the assurance processes should be carried out
periodically and used to drive improvement of the processes.
New corrective work orders and completed corrective and planned work orders should be reviewed for completeness
and quality. Work order data quality reports can be used to improve the standard of work management and work
history recorded in the MMS.
Plant Performance Management

Successful Integrity Management requires the ongoing monitoring of performance in order to generate data
by which to judge the success, or otherwise, of specific strategies. Performance results need to be published
and analysed, and improvement in performance can only be realistically achieved when management is properly
informed about current performance.
KPIs are recommended in the next paragraph, but in the absence of KPIs there shall always be some form of
reporting to senior management of Monitoring and trending of safety critical equipment performance, together
with equipment failures and failure to meet the required Performance Standard, with any corrective measures
taken as necessary.
Key Performance Indicators (KPIs)

Indicators of successful performance to promote integrity are an essential feature of a good Integrity Management
System. Indicators can be leading, where they flag low performance which could lead to problems or failures
ahead, or lagging, where they record numbers of defects or failures. It is essential to provide a clear definition
of any indicator to ensure that information is both consistently reported and clearly understood.
This will vary for each Duty Holder and no attempt to provide specific definitions is made in this section.
The following are examples of indicators, however these should not be taken as a conclusive or definitive list. Also
the specific definition of how these measures are defined needs to be carefully considered:
Safety Critical Backlog
-
planned maintenance backlog manhours
-
corrective maintenance backlog manhours
-
deferred maintenance backlog manhours
-
planned inspection backlog manhours
-
deferred inspection backlog manhours
SCE Verification findings
Number of Inhibits and Isolations under management
Number of and trending of impaired SCEs
Number of Safety Critical Anomalies under management
39
Measured results should be tracked against performance indicator targets which demonstrate progress towards
achieving and maintaining acceptable levels of integrity. Tolerability levels for the degree of acceptability of
performance against those indicators should also be set.
Performance indicators set and used within the governance process will be aimed at monitoring progress towards
excellent business performance, ensuring that good practice is being employed and that opportunities for
improvement are identified.
The leading and lagging indicators should be monitored and regularly reviewed by the asset management team
and a report of status should be made to senior management periodically.
Key Aspects to Consider to ACT upon Assurance Results

Management Review
The purpose of Management Reports or KPIs should be to allow further analysis and strategic actions to be taken
on the results of the monitoring and trending of safety critical equipment performance.
Opportunities for improvement should be identified and incorporated into appropriate plans or strategy updates.
Root Cause Analysis
Root Cause Analysis (RCA) techniques are used to investigate poor performance and / or failures and breakdowns.
RCA outcomes should be acted upon and the improvement action implemented should be reviewed at a future
date to confirm its effectiveness.
An Asset Improvement process should be in place to drive change and communicate lessons learnt across the
business. This should be developed from the identification and capture of findings from maintenance data analysis,
breakdown / incident root cause analysis and audits.
Measuring the Effectiveness of the Maintenance Programme

In order to effectively review the data provided by the CHECK activities above discipline specific Periodic onshore /
offshore reliability meetings should be held to review plant condition and reliability and maintenance performance.
Additionally, a periodic performance assessment meeting should be held with review topics, including trends from
condition monitoring, work order history, work scheduling, forelog and backlog management, materials usage
/ history and company and regulatory compliance. A plant performance and condition report should also be
developed periodically.
Regular assessments of the performance of suppliers of goods and services in the delivery of their activities in
relation to operational and HSE performance should be carried out and findings fed back to suppliers.
Training / Awareness
Finally, to ensure improvements in assurance strategies can be upheld it is always recommended that the workforce
should be given awareness presentations / training on Asset-specific integrity management objectives and initiatives,
eg. integrity expectations, corrosion management, fabric maintenance, HC leak reduction measures, safety critical
equipment maintenance, management of temporary repairs etc.
40
7. VERIFICATION - SUPPORTING THE ASSURANCE PROCESS
Introduction
The following section provides guidance and good practice on how to implement Verification. Not all parts of the
following text are regulatory requirements and each Duty Holder is free to interpret Regulations and HSE Guidance
as they see fit, however, the application of practices such as these will assist Duty Holders in improving Major
Accident Hazard management and compliance with UK offshore Verification requirements.
The Legislative requirements are clearly documented in the Regulations and are referenced and explained in the
section titled Offshore UK Legislation (Page 10). The HSE also provides good guidance on these Regulations which
should be referenced when seeking support.
Verification Process
The purpose of the Verification Scheme is to ensure that SCEs are, and will remain, compliant with Performance
Standards through each phase of an installations lifecycle. Implementation of the Verification Scheme provides
additional confidence, independent of the Duty Holders Assurance process, that the parts of the installation
deemed to be Safety Critical are suitable or actions necessary to support their suitability are identified.
Verification Schemes
A Verification Scheme specifies the activities, in terms of nature and frequency, which the ICP will perform to
examine the SCEs. The ICP completes the specified Verification and reports the results to a specified person within
the Duty Holders organisation. Responses to ICP Findings are recorded and held by the Duty Holder. A good
Verification process will not only ensure compliance with the Legislation, but will drive real improvements to the
Assurance process associated with SCEs and Specified Plant. (See examples of good Verification in Appendix 1).
Within this document, where it states Verification Scheme it is intended that this includes SCEs and Specified
Plant as per the statement in the OSCR Guidance Introduction Verification (Para 53) where it states:
The 2005 OSCR combine the requirements of the Verification Scheme with that of the Written Scheme of
Examination (WSE) formerly required by PFEER to create a single Scheme.
For clarity, under the OSCR Guidance, Reg. 2 Para 87 states:
Specified Plant, provided to comply with PFEER, is another component of the provisions relating to
Verification Schemes.
This is why most Duty Holders now have a single Verification Scheme that includes the identified Specified Plant
under the PFEER Regulations (formerly within a Written Scheme of Examination (WSE) along with the identified
SCEs.
The Verification Scheme defines specific Verification activities to be performed by the ICP to confirm the initial and
continued suitability of the SCEs for each phase of an installations lifecycle. Initial suitability is a commonly used
term which has evolved in the industry and represents the condition and capability of an SCE following completion
of design, fabrication, construction and commissioning phases. This initial and continued suitability, through the
remaining phases, will be verified against the specific performance criteria given within the Performance Standard.
Schedule 7 of the OSCR outlines the Matters to be provided for in a Verification Scheme.
41
The Duty Holder must ensure that a Verification Scheme is developed by, or in consultation with, an ICP, to contain:
The principles for selection of the ICP. Defined criteria for the appointment of the ICP, including
measures to ensure their competence and independence
The principles for review of the Scheme
The arrangements for communication of necessary information
The nature and frequency of examination and testing of SCEs / Specified Plant, where:
- Nature - details the SCE Verification activities to be completed by the ICP; ie Review, Examine, Inspect,

Witness, Audit etc
- Frequency - quantifies how much the ICP will do in terms of sample size and period that the activity
re-occurs
Arrangements for review and revision of the Scheme
Arrangements for making and preserving records of examination and testing, findings, remedial actions
recommended and remedial action performed
Arrangements for communication of records to an appropriate level within the Duty Holders organisation
It is recommended that when setting the nature and frequency of examination in the Verification Scheme, the
HSE - HID Semi Permanent Circular / Enforcement / 43 / Nature And Frequency Of Verification Of Safety Critical
Elements / 1st Nov 2002 is considered. The following is an extract from this document:
SCR Schedule 9 lists the matters to be provided for in a Verification Scheme - this includes the nature and frequency
of examination and testing carried out for the purposes of the Scheme. Guidance paragraph 65(a) indicates that
an issue for consideration by the Duty Holder is whether an Independent Competent Person (ICP) has an adequate
number of suitably qualified staff.
Inspection has shown that some Verification Schemes do not provide sufficient definition of the means by which
an ICP ensures SCEs are suitable, or that they remain in good repair and condition.
The most common shortfall is a failure to provide a clear indication of the nature and frequency of the Verification
activity (particularly the extent of offshore testing or the proportion of maintenance records reviewed) that the
verifier is expected to carry out.
Enforcement Guidance
A suitable Scheme (SCR Guidance para 63) must include a commitment by both the Duty Holder and the ICP to
a defined level of activity. What level is actually appropriate will vary considerably depending on the particular
criticality and number of the SCEs. For example:
A high integrity protection system, preventing the over-pressurisation of a hydrocarbon system, may require
100% witness by the ICP
A Fire and Gas detection system with many detectors could be covered by the witnessing of 15% of the
actual testing regime. Anything less than a 10% sample size is unlikely to be statistically satisfactory
Where Verification activity is also carried out by the review of test records and results, similar principles apply.
Sample size is particularly significant in this instance when the Performance Standard of an SCE requires the
ongoing check of its availability/reliability
This should apply to Operational, Project and Modification Verification Schemes. Terms such as Opportunistic
/ ICP discretion / Witness or Review should not be in the Verification Scheme activity as they all allow for the
activity to be influenced at the time dependent upon resource or budget constraints etc.
Documenting how much the ICP should do is difficult but will support compliance with the Legislation and can be
achieved through specifying percentages or quantities of items and records to be verified. The Duty Holder should
define these requirements within their Verification Scheme and seek ICP approval of the content.
From the guide to the OSCR (Schedule 7 Para 337) it states that there should be arrangements made to ensure
that the sample taken is not repeatedly tested. The Duty Holder should therefore ensure this is covered in the
Verification Scheme and audit the ICP on how this is being managed.
42
Operational Verification Activities

Typically, an Operational Verification Scheme will specify the following types of Verification activities:
Type
Verification Activities (Nature)
Offshore
Witness SCE Assurance activities (eg tests / inspections / musters

etc)
Visually examine condition of SCEs (eg piping, vessels, hazardous
area equipment etc)
Audit compliance with SCE Assurance Processes (eg Control of
Temporary Equipment, Management of Inhibits, Control of Lo/Lc
Valves, Management of Defined Life Repairs etc), through
inspection and, testing, and the review of any offshore records
Onshore - Assurance Management

System
Review Maintenance and Inspection records confirming they are:

- suitable for assuring the Performance Standard
- conducted at the specified frequency
- reported correctly stating As-Found and As-Left condition
- reporting remedial work and ensuring it has been correctly
prioritised / executed
Review planned maintenance deferrals Detailed Procedural
Compliance Audits (typically on a less frequent basis) of specific
SCE assurance management systems, eg Piping and Vessels
Inspection strategy encompassing the RBI implementation,
defined life repairs etc.

Many Duty Holder Performance Standards quote reliability / availability figures. The ICP should review how the
Duty Holder assures that these figures are being met. In relation to this, the ICP should ensure that any repeated
failures to operate are identified and reported.
ICP Responsibilities
The ICP has a responsibility to:
Comment on the record of SCEs
Draw up, or be consulted in the development of, the Verification Scheme and thereafter the periodic review
Perform Verification activities as defined in the Verification Scheme
Report to the Duty Holder on the suitability of SCEs detailing Examinations / Reviews performed, Findings
and Remedial Actions Recommended
Communicate any reservations on the List of SCEs or the content of the Verification Scheme to the Duty Holder
Effectively, the ICP is providing an independent view of the initial and ongoing suitability of the SCEs and PFEER
specified plant to manage the risks through the means defined in the Safety Case, and translated through the
Performance Standards. The Duty Holder retains accountability and responsibility for managing risk through management systems and processes, people employed and their effective function, and the plant provided and its
condition.
43
It should be noted that the defined role of the ICP under the Safety Case Regulations applies to activities in support of establishing the physical condition of plant and does not formally encompass the associated and essential
activities in support of safety through corporate company management processes and procedures, or through the
company culture or active contribution through personnel performing functions. These systems and roles and their
effective performance are as essential to managing safety as the condition of the plant, and are required to be
addressed by the Duty Holder. The ICP should however identify errors in Assurance management processes which
could compromise the objectives of the SCE, ie being effective when required. This means that the ICP must undertake sufficient activities in order to form a professional judgement whether the SCEs are likely to remain in good
condition and repair and function as required until they are verified again.
Verification Scheme Process for which the Duty Holder is accountable

ASSURANCE BY
DUTY HOLDER
VERIFICATION BY
INDEPENDENT
COMPETENT
PERSON (ICP)
Identify Major Accident

Hazards and Conduct
PFEER Assessment
Identify Safety Critical

Elements and
Specified Plant
Set Performance
Standards
Review and Develop
Means of Assurance
Implement Assurance
Activities through the
Maintenance
Management System
Projects & Modifications

Modify or put in new
Safety Critical Elements
YES
Review and
Comment
Develop
Verification Scheme
(Operations
/ Projects /
Modifications)
Completed by /
or in consulation
with ICP.
ICP to comment
on suitability
of scheme
Execute
Verification
Activities in
accordance with
Scheme
(Report/Track)
New
SCEs
NO
Figure 5
44
Initial Suitability
The previous sections have outlined what must be written in a Verification Scheme. This section is specific to Initial
Suitability, ensuring that before SCEs become operational they have been subject to a suitable Verification process.
Whether a project or modification introducing new / additional SCEs is greenfield (all new) or brownfield
(major upgrade or change to existing facilities), a Verification Scheme must be in place to suitably detail the
Verification activities, as described previously, for the various phases as follows:
Phase
Duty Holder SCE Assurance (1)
ICP Verification Activities (2)
SCE Identification
Identify and Record SCEs being

installed or impacted by the Project /
Modification
Comment on the List of SCEs

Define high level Verification Work
Instruction
Review and comment on Master
Document Register provided by
Engineering contractor.
Design
Design Documents: P&IDs / C&Es

/ Calculations / Specification Data
Sheets etc
Review Design Documentation

Audit Design Process
Review technical deviations to
Provide record of review including
comment.
Procurement
Quality Assurance Checks on

equipment / materials ordered and
received
Review / examine Procurement Orders

and Goods received
Fabrication / Construction
QA Plans
Quality Assurance Inspections /
Reviews
Examine / witness Fabrication /

Construction.
Review Fabrication / Construction
Dossiers (Material / Welding / NDT /
Testing records)
Transportation / Installation
Quality Assurance Inspections
Examine equipment
Review records
Site Commissioning
Testing of SCEs / Specified Plant to

assure compliance with Performance
Standards
Witness testing
Examine equipment against design
Review records
Review punch-list items
Review technical deviations
Close out / Handover to

Operations
Compile and review closeout packs

Populate relevant Duty Holder
databases for SCE maintenance /
inspection
Issue handover documentation
detailing any outstanding items,
including Verification activities and
findings
Review databases for population

of new equipment and suitability
of assigned operational assurance
activities, eg maintenance / inspection
Review outstanding punch-list items
and status of Verification
45
Notes:
1) The Duty Holder must ensure that the Performance Standards are being met by embedding them into each
phase of the Assurance Process and making
people accountable for compliance. This can be achieved by obtaining appropriate engineering signatures to
confirm compliance to the Performance Standards at
key stages.
2) The Verification Activities will be as detailed within the Duty Holders Verification Scheme.
3) The Duty Holder should request the Engineering Contractor to provide a list of the documents (Master
Document Register, MDR) that will demonstrate compliance of each impacted SCE against the applicable
Performance Standard criteria. This approach raises awareness with the Engineering Contractor of their duty of
cooperation that the Duty Holder can demonstrate compliance to their Performance Standards. This approach
also provides the ICP with higher confidence that SCEs are being suitably managed
One method of fulfilling the legislative requirements is to have, within the Verification Scheme, Initial Suitability
Verification activities for each SCE that can be applied to any Project or Modification. In doing so, the activities are
written in advance and can be fine-tuned depending upon the Project / Modification.
As per the Operational Verification Scheme, the frequency that quantifies how much the ICP has to do should
be based on the criticality of the SCE, eg detailed design reviews for critical items such as risers, fabrication
examinations during construction of key components, witnessing of critical commissioning tests like ESD and
blowdown etc
As the ICP gains confidence in the Assurance process, the frequency (eg sample size) may be reduced as
determined by the Verification Scheme. For example, if several deluges were being installed by the same Engineering
Contractor in the same period of time, there may be an opportunity to conduct the full Verification scope on the
first deluge set and if the Assurance process was found to be working well, the ICP may only need to witness
the remaining deluges. Any changes to sample size should be agreed between the Duty Holder and ICP. It should
be emphasised that this practice is appropriate for the project phase but care should be taken in applying such
measures in the operational phase.
The Duty Holder should determine the right time for the ICP to review documentation to ensure they do not
become part of the Assurance process. In turn, it is important that the ICP is involved early enough to ensure
that selected solutions will meet Performance Standards once fully developed and avoid the need for substantial
re-work at a later stage.
46
Operational Verification Activities

Typically, an Operational Verification Scheme will specify the following types of Verification activities:
Type
Verification Activities (Nature)
Offshore
Witness SCE Assurance activities (eg tests /

inspections / musters etc)
Visually examine condition of SCEs (eg piping,
vessels, hazardous area equipment etc)
Audit compliance with SCE Assurance Processes
(eg Control of Temporary Equipment,
Management of Inhibits, Control of Lo/Lc Valves,
Management of Defined Life Repairs etc), through
inspection and testing, and the review of any
offshore records
Onshore
Review Maintenance and Inspection records

confirming they are:
- suitable for assuring the Performance
Standard
- conducted at the specified frequency
- reported correctly stating As-Found
and As-Left condition
- reporting remedial work and
ensuring it has been correctly prioritised /
executed
Review planned maintenance deferrals
Detailed Procedural Compliance Audits
(typically on a less frequent basis) of specific
SCE assurance management systems, eg Piping
and Vessels Inspection strategy encompassing the
RBI implementation, defined life repairs etc. KP3
Style audits can be used as a basis for these types
of audits
Many Duty Holder Performance Standards quote reliability / availability figures. The ICP should review how the
Duty Holder assures that these figures are being met. In relation to this, the ICP should ensure that any repeated
failures to operate are identified and reported.
47
Management of Verification
The expectations of Verification should be defined and clearly communicated to both onshore and offshore
personnel. This can be achieved through corporate policy / Verification Scheme / Job Descriptions / Verification
procedures / presentations etc.
Senior management should support the Verification process as it is a useful measure of the status of their SCEs.
They can support the process by:
Ensuring Verification is completed (Projects / Modifications / Operational) through appropriate resourcing
within Duty Holder and ICPs organisation / tracking Verification completion / Managing responses to ICP
Findings / Attending Duty Holder and ICP interface meetings
Setting Corporate Verification KPIs, eg Completion of Verification Annual Workscope / Reduction in overdue
ICP Findings etc
Duty Holders should detail how they manage Verification. This is typically done through a procedure or in the
Verification Scheme and would normally be integrated into the Duty Holders Safety Management System.
The process of how to manage Verification (Operations / Modifications / Projects) should define requirements for:
Planning:
- Ensure effective interface between ICP and planning departments
- Ensure good communications prior to execution of Verification activities with relevant personnel making

them aware of the proposed Verification Scope
Reporting of Verification Activities
Reporting of Verification Findings (Refer to Findings Management below)
Clear lines of communication between the ICP / Duty Holder and Engineering Contractor where appropriate.
(an organisation chart may be beneficial here to identify key positions)
Review and Revision of the Verification Scheme
Roles and responsibilities. It is useful to include an organisational chart defining reporting routes for Verification
Describe how both the arrangements for well examination and the Verification Scheme capture all wells and
well-related equipment
Verification roles and responsibilities should be defined within personnel job descriptions (for offshore and
onshore personnel) if Verification is their primary role and personnel should be made aware of their roles in the
delivery of Verification
ICP Responsibilities
The ICP has a responsibility to:
Comment on the record of SCEs
Draw up, or be consulted in the development of, the Verification Scheme and thereafter the periodic review
Perform Verification activities as defined in the Verification Scheme
Report to the Duty Holder on the suitability of SCEs detailing Examinations / Reviews performed, Findings and
Remedial Actions Recommended
Communicate any reservations on the List of SCEs or the content of the Verification Scheme to the Duty Holder
Effectively, the ICP is providing an independent view of the initial and ongoing suitability of the SCEs and PFEER
specified plant to manage the risks through the means defined in the Safety Case, and translated through the
Performance Standards. The Duty Holder retains accountability and responsibility for managing risk through
management systems and processes, people employed and their effective function, and the plant provided and
its condition.
48
It should be noted that the defined role of the ICP under the Safety Case Regulations applies to activities in support
of establishing the physical condition of plant and does not formally encompass the associated and essential
activities in support of safety through corporate company management processes and procedures, or through the
company culture or active contribution through personnel performing functions. These systems and roles and their
effective performance are as essential to managing safety as the condition of the plant, and are required to be
addressed by the Duty Holder. The ICP should however identify errors in Assurance management processes which
could compromise the objectives of the SCE, ie being effective when required. This means that the ICP must
undertake sufficient activities in order to form a professional judgement whether the SCEs are likely to remain in
good condition and repair and function as required until they are verified again.
Duty Holder Responsibilities (directly related to Verification)

The Duty Holder must:
Define criteria for the appointment of the ICP
Periodically review the competence and independence of persons executing Verification activities
Provide adequate resources to facilitate the management of Verification including the necessary financial
provisions. This is partially achieved by having clear nature and frequency defined within the Verification
Scheme in order that suitable ICP resources can be resourced to execute the workscope
Periodically audit the Verification Scheme as part of the overall Safety Management System (SMS)
Ensure that a periodic review of the Verification Scheme is completed by, or in consultation with, an ICP and,
where necessary, revise or replace it. This should consider the evolving phases of the lifecycle, material changes
and thorough reviews of the Safety Case, and the impact of ageing where a more thorough review may
take place
Ensure that a note is made of any reservations made by the ICP on the record of SCEs or on the Scheme. It is a
requirement that the ICP will review and agree the list of SCEs and Specified Plant. The list should be formally
issued by the Duty Holder and all responses should be logged. Additionally, there should be a record of the ICP
review of the Verification Scheme
Ensure that the Scheme is put into effect
Notify the ICP in the event of major repairs and breakdowns of SCEs
It is recommended that regular meetings are held between the ICP and the Duty Holder to get an understanding
of the status of activities completed so far, and the status of SCE compliance with Performance Standards
A correspondence file should be kept by both the Duty Holder and ICP
Manage Interfaces between two or more ICPs: Where more than one ICP is appointed by the Duty Holder,
arrangements should be in place to manage interfaces, in terms of responsibilities, communications and
Verification scope, to ensure that the process is effective with no gaps
Additional Activities by Duty Holder to assist verification process
Ensure ICP Access to the Duty Holders Assurance Management System, Safety Management System and to the
records of any specialist companies which the Duty Holder is using to manage their SCEs. It is recommended
that the ICP holds a controlled copy of the Verification Scheme distributed through a formal transmittal process.
ICP Training: Assurance Management System Training should be provided to the ICP by the Duty Holder to give
the ICPs an understanding of the Duty Holders assurance process and ability to efficiently access records.
Setting of KPIs - Contracts can benefit from KPIs provided they are fair, measurable and do not drive influence
or impact on the independence of the ICP. If managed well, they drive and maintain performance. These could
be around continuity of personnel / delivery of reports / timely response to Verification findings, completion of
activities within programme etc. Note this can apply to the ICP as well as the Engineering Contractors involved
in Verification.
49
Further Verification Good Practice / Guidance

The following section specifically provides further guidance on the implementation of Verification and identifies
what is considered to be current good practice within the industry.
Planning
Good planning of Verification activities is key to ensuring the scope is completed in the most efficient manner. The
ICP will need good access to the asset / project plans in order to identify appropriate times for visits and even to
link visits to certain key activities, eg Riser ESDV testing.
It is recommended that the ICP is on the distribution list of relevant asset / project plans. Current good practice
is to ensure that Assurance Routines are specifically scheduled to match the verification activities for and ICP
offshore visit; this allows offshore personnel to be ready and available and ICP should equally be expected to be
have reviewed the planned activities prior to offshore visits.
It is important, particularly on Projects and Modifications, that the ICP is engaged during the planning process in
order to allow assignment of suitable resources to execute the Verification workscope at the appropriate times. For
Verification to be of value, it must be completed as close to the assurance taking place as possible. This means the
ICP should be involved early in each phase and they should complete their activities in a timely manner to avoid
raising findings after the project has moved to the next phase.
For all Verification scopes, it is recommended that the Duty Holder makes expectations clear to the ICP in terms
of completing the scope. This can be achieved by setting Verification milestones, eg. Design Verification to be
completed by a certain date or Annual Operational Verification scope to be fully completed by a certain date. This
then provides visibility to the ICP of the expectations of the Duty Holder and S curves can be used to monitor
progress versus plan.
Reporting
Verification Progress Reporting:
The Duty Holder should monitor progress / completion of the Verification activities on a regular basis throughout
the year to demonstrate progress. This allows review meetings to be held with the ICP to agree effective actions
and to develop a recovery programme.
Failure to complete the planned Verification could ultimately lead to an Improvement Notice from the HSE. ICPs
should also raise concerns when the Verification programme is not being completed in a timely manner.
Senior management should be kept informed using KPIs and / or progress reports.
The ICP should not credit completion of the scope of Verification unless the activity has been fully completed. Any
incomplete activities for the year should be highlighted to the Duty Holder and clearly shown on the plan. It is
good practice for the Duty Holder to audit the ICP on how they credit the Verification activities from their reports
to show status of completion and thereby improve the clarity of what has been done.
Verification Activity Reporting:
The ICP report should contain adequate information to confirm completion of the Verification scope of work.
Reporting by exception is not deemed suitable, ie both positive and negative findings should be reported.
The reports should clearly state whether the SCE examined meets the Performance Standard. Through the process
of Verification activities, where the ICP notes deficiencies within the Performances Standards or Verification Scheme
these should be formally raised to the Duty Holder. This process should be documented within the Verification
Scheme / procedure.
50
For Findings raised by the ICP, the Duty Holder should aim to identify and remedy the root cause in order to avoid
reoccurrence and to promote internal learning.
To aid the Duty Holder in achieving this goal the ICP should carry out a targeted review where he has concerns for
the findings raised:
Check for common and systemic failures by reviewing the maintenance management system and previous
findings raised
Check if the failed equipment was being suitably maintained by reviewing the appropriateness of the
maintenance / inspection routines, including content and frequency
This review may identify inadequate / missing Planned Maintenance Routines (PMRs), PMR content or frequency
and can support investigation of training, competency or compliance issues if the PMR was recently completed
and no faults were reported etc.
This approach gives the ICP a fuller picture of the issue raised and the outcome of this review can be included
within the finding with the action aimed towards driving the Duty Holder to identify the most effective solution
which will prevent reoccurrence.
The ICP should issue the Verification reports in a timely manner. Typically, a target for issuance of reports should
be agreed with the ICP, normally within 5-10 working days following completion of the visit to site would be
considered reasonable. It is also good practice for an informal, and unofficial, quick report to be provided to
appropriate parties when leaving the site to allow early attention to matters raised.
The completed report should be issued to the Duty Holders Verification Focal Point who should then manage the
report control and distribution.
It is considered best practice that each Verification report should typically include the following information:
Unique report number
SCE examined
Performance Standard reference.
Unique Verification activity identifier and description
Description of the examination activities completed
Details of equipment / records examined
Percentage of activities completed against the requirements of the Verification Scheme
Documents reviewed and other relevant references
Details of any outstanding activities; including reason for activities not being completed (statements like
due to operational reasons should be avoided)
Findings from the examination (eg is the Performance Standard measurable compliance criteria met); Note
that photographs and drawings greatly enhance the quality of the report and should be used where possible
Remedial Actions Recommended to the Duty Holder
Details of personnel attending close-out meeting at site
Name(s) of the ICP individual(s) that undertook the examination / audit
Signature by the ICP author and reviewer
The OIM and appropriate personnel should be notified immediately if a finding is raised during offshore activities
that identifies a failure of a Performance Standard.
Periodic Verification Status Reporting: It is recommended that the ICP provides a regular report / presentation to
include the following:
An overall Verification activity progress versus plan status
Highlights of completed and planned Verification activities
Areas of concern
51
Status of Verification Scheme activities by SCE

Status of outstanding actions from meetings / formal correspondence
Any lessons learned that could be deemed as best practice from other Duty Holders
In order to demonstrate compliance with Legislation, records of activities supporting Verification shall be maintained
in an auditable and retrievable manner by the Duty Holder on their premises until 6 months after the Verification
Scheme has ceased to be current.
End of Year Reports: It is recommended that an annual Verification report and / or presentation (covering
Operational / Projects / Modifications) is completed by the ICP within 1 month of the end of the annual cycle,
where the status of Verification for the last year is communicated to the Duty Holders senior management and
interested parties.
Typically it should cover:
Verification progress versus plan
Verification Scheme status
The findings and associated recommendations including categorisations
Management of findings. The status of the findings showing open and overdue / As-found findings by SCE /
trends etc
Look ahead Forthcoming work and areas for improvement of the Verification Process
As-found suitability of SCEs
Financial status (may be addressed in a separate report / presentation)
An End of Year presentation by the ICP to the Duty Holders senior management complements the end of year
report and ensures awareness and an opportunity to reinforce leadership for MAH management.
Findings Management
The Duty Holders procedure / process for management and investigation of Verification Findings should be
adequately defined. This process should cover:
Reporting of Verification Findings. A visible and robust method of raising and closing Verification Findings is
required. Database systems are good practice as they can provide visibility of issues / control responses and
facilitate effective interrogation of the historical data to provide trends to assist in finding effective solutions
ICP involvement in the close-out of Verification Findings. For each closure it should be evident if the ICP agreed
with the closure or not. Where no ICP agreement can be reached on the closure of a Finding, this must be
formally recorded and the Duty Holder is accountable
Escalating Verification Findings, eg where no progress is being made and the Finding has gone past the due
date or where the closure of ICP Findings cannot be resolved. The Escalation process should ensure visibility of
the issue to senior management within the Duty Holders organisation
Letters of Concern. This is a commonly used method where the Verifier is able to raise concern regarding the
management of SCEs or the Verification process
Letters of Reservation. This term is defined in the SCR and represents the mechanism used by the ICP to
formally document unresolved matters relevant to the record of SCEs or the content of the Verification Scheme
Define who is responsible for responding to Verification Findings / Letters of Concern / Letters of Reservation
within the Duty Holders and ICPs organisation. Typically, Technical Authorities / Maintenance and Inspection
Discipline Engineers are assigned responsibility for SCEs in their area of expertise. The ICP that raised the
Finding is usually responsible for reviewing the response.
Verification Findings should be reviewed on regular basis by the Duty Holder and the ICP to update progress. It
is also recommended that management responsible for Asset Integrity and appropriate operations personnel are
involved in these meetings.
52
All Verification Findings should have realistic target closure dates which should be set appropriately by the ICP
and Duty Holder in accordance with the severity of the Finding. It is recommended that the ICP is in agreement
with these dates and any changes made to them. Good practice would be for a date to only be changed once, if
they are made in timely manner, and where suitable evidence demonstrating progress towards closure has been
appropriately managed to allow an agreed extension.
Verification Findings within the industry are categorised / named in many ways as per the requirements detailed
within each Duty Holder Verification Scheme. However, as an industry, Verification Findings are reported to Oil &
Gas UK for input into an industry KPI that tracks as an industry the level of open and overdue Verification Findings.
These are categorised as:
Level 1

Performance Standard satisfied, but ICP may suggest an improvement to the system or may
request additional information to demonstrate compliance with a Performance Standard
Level 2
Single Performance Standard failure with no immediate threat to the integrity of the installation
Level 3

Fundamental SCE Assurance system failures that need senior management to remedy and
/ or resource, Multiple failures of a Performance Standard and / or immediate threat to the
integrity of the Installation
The most up-to-date definition should be confirmed through reference to Oil & Gas UK.
Review and Audit

The Verification Scheme and associated key documentation should be kept under continuous review, revised as
often as necessary and maintained up-to-date.
In addition to periodic reviews, a Verification Scheme review should be initiated by changes such as:
Revision of any codes or standards referenced in the Verification Scheme
Modifications to the installation which result in amendments to the list of SCEs or Performance Standards
Revision to the installation Safety Case
Changes to the installation operating parameters
Changes to environmental conditions
Audits of the Verification management process should be carried out on a periodic basis which should include all
the key Stakeholders, including members of the Leadership Team. These audits should also cover the ICP to ensure
that the process remains compliant with Legislation.
Changes to the Verification Scheme need to be well managed to ensure all appropriate personnel are made aware
and necessary approvals are obtained. Depending upon the content of the Verification Scheme, SCE Performance
Standard owners (TAs), Discipline Engineers, Safety Engineering, Verification focal points and ICPs may need to be
involved.
53
Interface with Classification

Classification of MOUs, FPSOs and FPUs can be used as a basis for, or in support of, Performance Standard
requirements and activities to assure and verify compliance. The Classification processes provide good benefits in
the maritime environment of the offshore industry but do not imply compliance with SCR and PFEER examination
requirements alone, and should not be considered as a substitute or replacement for these. Classification Society
rules may be quoted as a suitable reference within a Performance Standard or, where not directly quoted, it may
be possible to demonstrate that they meet or exceed the requirements of the performance standard for a SCE and
the evidence of meeting Class (approval letters, product certificates, etc.) can be used as a basis for assurance and
Verification. Reporting of Verification activities should be completed in accordance with the requirements of the
Written Scheme of Examination (WSE).
Where Classification Society rules do not meet all the requirements of Performance Standards, Classification should
still be recognised as a contributor to Verification, but additional tasks will need to be completed by the ICP.
Well Examination Interface

The Verification Scheme has an interface with the Wells Examination Scheme.
DHSVs and Wellhead valves have been identified as safety critical and as such require their Verification through
the Verification Scheme Process. However, a Well is defined within the Design and Construction Regulations as
...any device on it for containing the pressure in it.... The interface should be established by the Duty Holder to
ensure there are no gaps, however, a common definition is considered to be the downstream flange of the Xmas
tree wing valves for producing Wells and the upstream flange in the case of injection or gas lift.
There is an overlap between the Verification Scheme Operations and the Well Examination Scheme. Activities
covered by the ICP often include the witnessing of the operation of the Xmas tree wing valves and the inspection
of the Xmas tree itself. Where appropriate, this information should be reported back to the Well Examiner. The
key is to ensure adequate communication between examining parties and avoid assumptions being made about
responsibilities and activities.
The effects of subsea wells and tie-backs outside the 500m zone should be considered when investigating MAH
scenarios. Duty Holders should consider if their subsea wells / structure / pipelines will be Safety Critical in the
future to the drilling vessels when drilling operations are taking place over them. With this knowledge, the Duty
Holder may opt to undertake Verification in projects and operations knowing that some equipment will fall within
the 500m zone of the vessel and hence could be Safety Critical to that installation. In any case, Wells (including
subsea wells) attached to an installation may be included within the Verification Scheme or may be covered by
Well Examination.
Combined Operations (COMOPS)

Combined operations are defined as any operation involving the temporary interaction of two or more installations;
this may be, for example, a drilling rig operating alongside the platform, or a flotel being bridge-linked to facilitate
major works on the platform.
There are a number of interfaces during a combined operation, these interfaces can include hardware or software
interfaces (eg alarms and communications, means of access, firewater system interconnections etc), which are
likely to result in amendment to the record of SCEs for the respective installations.
54
The interfaces need to be clearly defined before the combined operations begin. It is recommended that a meeting
is held between management representatives of the Duty Holders and their ICPs for each installation involved to
understand and agree the SCE and Performance Standards affected, as well as the Verification activities required
by the two ICPs. Verification activities for Combined Operations should be put in place prior to the COMOPS and
carried out as required. Any changes to the Verification Schemes for each installation involved in the Combined
Operations could be included as an appendix for the duration of the combined operations.
The installation Duty Holders ICP will normally carry out interface activities between the installation and the Drilling
Rig / Flotel. Any Verification findings raised should be managed as per the Verification Scheme. Both Duty Holders
should be notified of the outcome.
Once the Drilling Rig / Flotel / Vessel has been removed, the ICP will usually carryout Verification activities to ensure
that the integrity of the Installation has returned.
Verification of Decommissioning and Abandonment

A controlled decommissioning and abandonment phase will commence following the end of the Operations
phase.
The activities required for decommissioning and field abandonment by the Duty Holder must be documented and
are subject to approval by the Health and Safety Executive and the DECC.
A new hazard assessment should be carried out with a revised list of SCEs required to manage those hazards. New
Performance Standards and means of Assurance and Verification will be developed which are relevant for the new
hazards. These may change during different periods of the Decommissioning process as hazards change and plans
should be set to review and revise these in a timely manner.
The Verification Management Procedure / Scheme will require development in the run-up to Abandonment,
as required by the Regulations. The Verification activities will have to be defined for each step, concentrating
particularly on what SCEs are required, what they must be capable of doing, and the order that safety critical
equipment is removed / switched off. Note that all SCEs must remain fit for purpose and be verified for continued
suitability until the associated hazard is no longer present, eg gas detectors must remain operational until the
installation becomes permanently gas free.
55
8.
Introduction
The publication of the HSE KP3 initiative progress report in July 2009 cited that there were still concerns with the
way operators interact with their verifiers and the use that is made of the Independent Competent Persons and
the full integrating of independent Verification activities into Duty Holders understanding of safety management
systems.
A key part of trying to resolve this issue relates to the nature of the relationships between the various Stakeholders
and the possible constraints that prevent closer integration. A Subgroup was established to specifically investigate
the issues and constraints to closer integration of Verification within management systems.
This section sets out the findings of the Subgroup investigating the issues to closer integration of the Stakeholders
associated with Verification.
Methodology
The Subgroup was made up of a range of parties associated with Verification, comprising representatives from the
HSE, Duty Holders, Independent Verification Bodies, Independent Competent Persons.
A number of working sessions were held by the Subgroup to try and identify and gain a closer understanding of the
issues that constrain closer integration. It was concluded that the best approach was to develop a questionnaire
and launch it across the wider industry.
The aim was to gain a deeper understanding of the level of knowledge of the purpose of SCEs and the role
Verification plays in their management, in particular amongst those at senior management level in organisations
with production and Duty Holder responsibility.
This approach was adopted on the hypothesis that leadership from senior management is the key to closer
integration of Verification. Gaining an insight into the understanding at this level would enable development of
targeted recommendations that could be driven down through the various organisations to bring closer integration.
The survey was conducted online with participation being anonymous. The analysis of the responses formed the
basis of the recommendations put forward in this section.
56
8.
Outputs from Working Group Sessions:

Potential Stakeholders are shown in Figure 6. On the right side are those with direct involvement, whilst those on
the left are more indirect but whose role will be far more prevalent should the effectiveness of the safety system
break down and allow a major accident to occur.
Government
Trade Associations
HSE
DECC
Licencees
News Media
Lobby Groups
Verification Process
Stakeholders
Independent Verification Bodies

Duty Holders
Public
Operators
Trade Unions
Offshore Workforce
Figure 6
A key factor identified to impact on the effectiveness of Verification is the nature of relationships between the
various Stakeholders and the possible constraints these present that may prevent closer integration. These high
level constraints are shown in Figure 7.
Human Factors
Authority
Expectations of the
role and purpose
from all parties are they different
Failure to understand
the benefits and
value of verification
within the integrity
process
Technical
Contractual / Commercial
Regulatory
Verification Relationship
Constraints
ICPs - DHs - Operators
Differences between IVBs

Competency of both
DH & IVB personnel in
managing relationships
(often too technical)
Lack of promotion of ICP
role accross the industry
Figure 7
57
8.
The most important of these constraints are further explained, as follows:

Authority A lack of consistent understanding as to what level of authority the ICP holds within the Legislation.
There was a perception that the ICP is a policemen for the Regulator.
Contractual Although the ICP position is required under Legislation, the contractual / commercial relationships
which prevail mean that challenges exist for the verifier to present potentially unpopular findings. The ability to
maintain independence and be constructive with Verification findings can be perceived as poor service and
possibly lead to loss of contract to competitors.
Technical Within the boundaries of technical competence, an individual ICP is often required to be a generalist
covering many disciplines rather than a specialist discipline engineer; this can lead to a belief that the ICP is not
knowledgeable enough in a particular area. Independent Verification bodies (IVBs) are typically large enough to
have technical specialist back-up across all disciplines. Where findings require specialist knowledge input which
would assist in the quality and clarity of the report, this should be incorporated prior to issue to the Duty Holder.
Findings
Responses received to the survey questionnaire were analysed and the results are set out in the table below:
Positive
There is a good understanding of
the purpose of the Safety Case
Regulations
Negative
The benefits are seen to be
Regulatory compliance rather
than direct business benefits of
managing safety in an effective
manner
Effectively controlling hazards and

the resultant impact on business
objectives is not broadly recognised
If there was no Verification, focus

on the Assurance process of hazard
management would slip
Verifier is part of Regulatory enforcement
There is unanimous recognition

that Verification has an important
role in hazard management
58
Discussion
Where verifier has regular meetings with DH management, this

improves the focus and value
Senior management often have no

interface with ICP
Without senior management

understanding and buy-in, the
value of Verification is always likely
to be diluted
Broad opinion that the role of ICP

could be expanded
Competency framework for ICPs

would be required to achieve this
There is a desire to receive more

value from IVBs
Regular change in asset ownership

or personnel within Duty Holder
organisation or verifier can
have a negative impact on the
effectiveness of major hazard
management
Importance of robust processes and

management of the Verification
system which can handle changes
such as this
8.
Conclusions
The following conclusions were drawn:
The key purpose of the Safety Case regime is to keep people safe from the major accident hazards that are
present in the exploration and hydrocarbon production environments offshore. Whilst this is a legislative
requirement, the clear benefit to the achievement of business strategy and objectives needs to be understood
such that leadership and commitment from senior management is not for compliance with Regulations but
for the benefit of the business and all Stakeholders. Making the connection between Regulatory compliance
and delivery of business objectives could enhance the focus for business leaders
Understanding the importance of Verification and its role in the prevention of Major Accidents by the
Stakeholders is essential
It is important that all persons within the Duty Holder organisation, from senior management to technician,
have a sound understanding of the role played by Verification. Without senior management involvement the
value is lost
The nature of the Offshore Oil and Gas industry, with continuous changes in Owners, Operators, Duty Holders
and personnel, means the value of Verification can easily be lost. It is essential that this is not allowed to
happen by ensuring effective Management of organisational change
Duty Holders and ICPs need to ensure there are robust mechanisms in place which describe the process and
emphasise its importance. These should include standard reporting mechanisms
Verification plays an important role in the achievement of business objectives through the assessment of
the level of compliance with management of safety critical systems. Independence in Verification adds a
greater level of transparency to the process and provides input to the Assurance framework that supports the
governance forums of the business
ICP reporting of findings from inspections needs to be comprehensive and justified, with due consideration of
the value to the Duty Holder
Recommendations
The following recommendations were made:
Further education is required throughout organisations on the purpose and benefits of the application of
the Safety Case regime and greater clarity in the roles and responsibilities of the participants in the process.
More proactive leadership by Duty Holders, complemented by promotional campaigns supported by the key
Stakeholders; Operators, Duty Holders, Regulators and Verification Bodies; will help raise knowledge and
awareness and remove constraints to closer integration of the role of independent Verification. This should
cover all phases and include Design Houses and the people conducting the Assurance activities
The Duty Holder interface with the ICP should be a relatively senior position within the organisation, with
access to senior management
ICPs should be encouraged to promote examples where Verification has added value and share lessons learned
with other Duty Holders
The way operators interact with their ICPs and the use that is made of their activities and findings needs to
improve
Management of organisation change shall be effectively implemented and should recognise potential impacts
on effective management of MAH
59
9. TRAINING, COMPETENCE AND ROLES AND RESPONSIBILITIES
Safety Critical Competency

Introduction
This section is intended to highlight two distinct issues identified under the terminology of Safety Critical
competency; namely:
Competency of ICPs - A lack of existing guidance on the meaning and assessment of ICP Competence
Wider industry competence (All personnel supporting the Assurance of SCEs) - To improve understanding of
Major Accident Hazard risk management and to help each person appreciate how their role in supporting the
condition of SCEs actively contributes to minimising the risk and potential consequences of a Major Accident
ICP Independence and Competence

Summary of Legislative Requirements
The Offshore Installations (Safety Case) Regulations calls for ICPs to verify:
that the safety-critical elements and the specified plant (a) are or, where they remain to be provided, will be
suitable; and (b) where they have been provided, remain in good repair and condition
The Regulations define how an ICP shall be considered Independent (ref SC Reg.7) but not how a person shall be
considered Competent:
INDEPENDENCE - SC Regulation 2(7) states:
For the purposes of paragraph (6) and Regulations 19 and 20 a person shall be regarded as independent only
where (a) his function will not involve the consideration by him of an aspect, of a thing liable to be examined, for which
he bears or has borne such responsibility as might compromise his objectivity; and
(b) he will be sufficiently independent of a management system, or of a part thereof, which bears or has borne any
responsibility for an aspect of which he might consider, of a thing liable to be examined, to ensure that he will be
objective in discharging his function.
COMPETENCE - SC Regulations Guideline Para 104 states:
In selecting competent persons to undertake examinations of safety-critical elements and specified plant under
the written Scheme, Duty Holders should ensure that the person chosen has adequate levels of technical expertise
and experience for the job.
An adequate examination of some equipment may require access to specialised technical knowledge. In other
situations, a lesser degree of technical specialisation may be appropriate.
PFEER Guidance Para 191 states:
Competence is not defined in the regulation but it includes having the necessary theoretical and practical
knowledge, and actual experience of the type of plant to be examined, to enable, in case of initial examinations, a
judgment to be made on the suitability of the plant, to enable defects or weaknesses to be detected, and for their
importance in relation to the performance required of the particular plant to be assessed.
60
Furthermore, the Regulations have an expectation that the Duty Holder shall be able to justify the choice of ICP.
SC Regulations Guideline Para 103 states:
Duty Holders are responsible for selecting people to carry out Verification work who are appropriately independent
and competent to do the work allocated to them. Duty Holders will need to be able to justify their selection and
may wish to make reference to existing standards and established Schemes for the validation of organisations
offering specialist services. However, Duty Holders are free to use other means of demonstrating compliance with
the legal requirements.
The intent of this guideline is to suggest a framework for a consistent approach to the documented assessment
of competence.
Documented Systems of Competency Assessment

Each ICP should have a system of documented competence with traceable means of assessment clearly stating the
competence criteria and method of assessing the individual ICP. This can be documented in different ways and
following provides an example of a framework for such a system.
In principle, an ICP competence scheme should contain the following elements:

Competency criteria by engineering discipline or SCE specific

Detailed criteria to define competence in general a combination of technical knowledge
and experience is required
Frequency of review and assessment
Definition of which lifecycle phase the person is considered competent for
Increasing levels of competence may be defined
Obligations of the Duty Holder

Both OSCR and PFEER place an obligation on the Duty Holder to satisfy themselves of the competency of their
selected ICP, where OSC Regulations Guidance Para 100 and PFEER Para 191 referred to above apply.
Duty Holders are legally responsible and should assure themselves that their selected ICPs are competent and can
demonstrate the same. Duty Holders can achieve this by:

Reviewing specified competency levels for ICPs

Reviewing / interviewing individual ICPs prior to acceptance
Documenting ICP acceptance
Conducting regular competency audits of their selected ICPs
Establishing the breadth and depth of knowledge of ICPs specific to wells and well-related equipment
The DCR place an obligation on the Well Operator to satisfy themselves of the independence and competence of
the persons examining any part of the well. The Oil & Gas UK Well Life Practices Forum has produced guidelines
on the Competency of Well Examiners.
Although it is not part of the regulatory requirements, it is recommended that this process of documented
competence review applies equally to internal Technical Authorities, safety-critical equipment vendors, service
companies and engineering contractors.
61

Name
Date of Assessment
Position
Legislative Understanding
Technical Qualifications
Relevant Experience
Communication Skills
Relevant Technical Training Courses
Formal Education Qualifications
Experience (outlining responsibility in

each area)
Technical and Personal Skills
Experience
Relevant Technical Training Courses
Application of Skills and Knowledge
Mechanical
Electrical & Instrumentation
Structural
Pipelines
Subsea
Drilling & Well Control
Marine & Safety
Process
Well Examination
Project Manager
Professional Qualifications eg C.Eng Professional Qualifications, eg C.Eng

Continuous Professional Development
Specialist areas;
D Design Review
C Newbuilding, Commissioning & Installation
S In-service ICP
Note that a person should be considered separately for competence in each of these areas within their chosen discipline
Levels of Competency
G - Gaining
C - Competent
E - Expert
62
Note that a person at Gaining level may still be considered for particular tasks but the level of additional monitoring should be
defined within the ICP quality system
On the job training and technical courses form part of the technical assessment programme, therefore as a minimum a person should
be considered gaining competence and have a base line knowledge strong enough to carry out activities with appropriate levels
of supervision
Wider Industry Safety Critical Competence & Awareness in the Management of Major
Accident Hazards
What do we mean by SC & MAH Competence / Awareness
The OSC Regulations have clear expectations for safety critical plant and hardware through the full lifecycle.
What is not specially considered is the personnel interacting with SCEs. Without a clear understanding of the
intent of the Regulations, how compliance is achieved, how SCEs shall be suitable on a continuous basis and how
it is important that they should operate on demand, there may be a detrimental impact or degradation on the
performance of the SCE. For example:

The Operator / Technician hits the clack valve first to ensure the deluge works first time
The Instrument Technician calibrates gas detectors before applying the test gas
The Engineer strokes the valve first before recording the closure time
The Scaffolder erects the scaffold in front of deluge heads / gas detectors / escape routes / emergency exits etc
without suitable risk assessments
Project Engineers design modifications without consideration of SCE performance standards or potential
impact on other SCEs
Poor recording of maintenance history
Poorly completed safety critical impairment assessments
Personnel may be technically competent within their own discipline but often fail to foresee that their actions may
have far reaching implications in the event of a Major Accident.
How can SC / MAH Competence and Awareness be Improved

The following are intended as proposals to the industry to be adopted as means to increase competence in this
safety critical aspect:
Educational / Training Campaigns to promote understanding of:
- SCEs as barriers to MAHs
- Performance Standards and how they link to MAHs
- Assurance and independent Verification processes
- How individual actions can impact on the health of an SCE
Detailed follow-up to promote the intent and value of the campaign, using:
- Roll-out through Safety Committees and Representatives
- Questionnaires to engage personnel and promote a base level of understanding
A Specific industry-wide MAH Training Programme (similar to or an extension to MIST) with the specific intent
of improving competency in this area but including some or all of the following elements:
- Explanation of SC Regulations document hierarchy
- Meaning of SCE, link to MAH and how PSs are created
- Role of independent Verification within Duty Holders responsibilities
- Barriers concept, using examples of cumulative failures
- Safety critical impairment risk assessments, clear examples showing correct application across interacting
SCEs
Persons with a more detailed role in safety critical health assurance should be identified for further detailed
training
Competency requirements for persons with a level of responsibility for SCEs should be defined within the
particular organisations quality system; from technician through to senior management level
63
Management of Change Technical Modifications impacting on SCEs

Management of Change is one of the most important elements supporting major accident prevention throughout
an Assets lifecycle. Poor identification of the hazards and risks exposed by change leads to improper change
management and the potential for catastrophic incidents. An effective change management process will improve
safety levels, production and product quality, Regulatory compliance, environmental performance and preserve
company reputation. This requires awareness of potential risk, and the proper controls and governance to mitigate
those risks.
Introduction
In any business, the process of assuring the beneficial improvement of key processes and equipment vital to
efficient and safe operation is an important one. It is essential that a consistent approach is used to assure changes
proposed will provide sustained benefits and will not cause consequential losses on other linked processes and
equipment. For this reason, Management of Change (MOC) associated with technical modifications is normally a
key process in company management systems.
Normally the major threat in relation to MOC is that a change is not recognised in the first place, followed by the
failure to identify change impacts and implement appropriate actions that allow transition to the change. This is
evident from examination of a number of globally reported major incidents, where investigations revealed failure
to manage change as a root cause or a significant contributor.
The ability to manage change first requires recognition that a change is being made. A change is something that
is different from what is already documented, presenting risk to the business requiring careful management. For
this reason, active leadership of MOC is essential.
A similar process will normally also apply to organisational change which will cover the impacts of reorganisation
and restructuring within companies, but this is not addressed under this section.
In the Offshore Oil and Gas industry the proximity of personnel to the extraction, processing, storage and export
of hydrocarbons, with more difficulty in evacuating to safe distance, presents a relatively higher hazard to that
of onshore industries. For this reason, Management of Change requires a higher level of application, control,
Assurance and Verification. Verification by ICPs of modifications to SCEs is a requirement of the Safety Case
Regulations.
What can go wrong with changes?

The Oil and Gas industry in the UK witnesses many incidents involving events where loss occurred as a result of a
poor application of Management of Change. To illustrate the importance of having a robust process for managing
change and ensuring that it is rigorously applied, the following fictitious example is outlined as a realistic event:
During the shutdown of an installation for planned maintenance, repairs and controlled modifications,
an Operator decides that this is the opportunity to install a pressure gauge on a fuel gas knock-out pot
to improve knowledge of conditions during operation. As the relevant vessel has already been isolated,
purged of all gas and fluids and open to atmosphere for internal inspection, the individual simply raises
a job card to modify an existing small bore branch on the vessel and fits a standard gauge taken from
stores with a screwed fitting. The job card may have been subject to scrutiny offshore during the daily
review of activities by the offshore management team and a risk assessment may have been carried out
to support the apparent minor modification. Checks of the installation are completed by an inspector, but
the modification is not sent through the MOC process for formal review and authorisation by the relevant
Technical Authority.
64
Following start up of operations, the gauge fails and gas is released into the module. Unfortunately, there
is no check valve or any form of isolation valve and there is no way to arrest the release of gas until the
section isolated by process ESDVs fully exhausts to atmosphere. Fortunately, no ignition occurs as electrical
equipment in the module is correctly specified, certified and maintained up-to-date. This was effectively
a very serious near miss which could have led to a catastrophic event in the form of explosion, fire and
escalation to other parts of the plant.
This is one simple example but it illustrates why even simple modifications need to be controlled by the application
of a consistent procedure, correctly engineered and subject to review by authorised persons before commencing
change.
What is the objective of a Management of Change process?

The MOC processes will normally have an objective, an example of which is provided below:
The objective of management of change should normally be to ensure that any relevant change is managed
to minimise disruption to the continuing delivery of the business whilst maintaining rigorous health, safety
and environmental standards, and the elimination of potential risks.
What represents a modification requiring Management of Change?

While each business may have a different definition for this, a typical definition of what constitutes a relevant
change is essential, and this can take the form of the following:
Modifications meeting the following criteria will require the use of the Change Management process, although
this list should not be considered exhaustive:

Changes affecting the Functionality, Availability, Reliability or Survivability of a Safety Critical Element
New Process facilities / equipment including Temporary Equipment and facilities
Removing or by-passing equipment
New chemicals
Change of specification of equipment
Change in engineering procedures
Change in maintenance regime
Cumulative effect of a multitude of small changes
The following are not Technical modifications:

Like for like replacement of equipment

Like for like replacement of chemicals
Changes to operational parameters within design limits
Routine activities covered by standard maintenance and operations procedures (eg scaffolding, inspection etc)
Activities that are undertaken under other management controls, such as operational risk assessment
Like for like replacements should be carefully checked to ensure that this is truly the case. In some cases, the
manufacturer may have modified or improved their product creating a conflict with, or an additional change to,
the system within which it will be installed.
65
All major modifications, projects and brownfield changes should be subject to an MOC process to examine Design
/ Manufacture / Construction aspects with regard to their suitability to comply with Performance Standards, and
this process should be embedded in the Projects Group.
Combined Operations of platforms and mobile units (eg rig, flotel, work barge) should include MOC assessments
to establish the impact on SCEs. This should include a systematic review of:
MAHs, SCEs, PSs, Assurance and Verification to identify what is a) new, b) altered and c) not altered; with
actions to address a) and b)
Verification and Classification issues and their impact on the above
The output should establish any changes necessary and any changes required to the existing Assurance and
Verification activities required to ensure safe combined operations.
Who should be involved in the MOC process?

The process should define key personnel to be involved in the process and their responsibilities. Typically, this may
consist of:
The originator, initially anybody who wishes to make an improvement to Safety and Business Critical plant and
Equipment through a modification to existing provisions, can make a proposal outlining proposed changes and
the benefits to be gained
A person may be appointed to be responsible for screening proposals and ultimately approving them following
satisfactory review. They should have the authority and technical competency for sanctioning MOCs
Technical Authorities for relevant disciplines may be called upon to assess proposals
Facilities or Engineering department representative who will receive a sanctioned MOC and carry out detail
design
The ICP for the scrutiny of impact of changes to SCEs
Where activities are delegated to a contractor, it is important for the Duty Holder to ensure that the change is
effectively managed to comply with their MOC process and that Assurance and Verification needs are satisfied
Some permanent and temporary well-related equipment may be included in the installation Verification Scheme
or a third party suppliers Assurance Scheme or may be covered by the arrangements for well examination. It is
essential that changes to wells and well-related equipment are reviewed by persons with the requisite technical
competence
What is the Process to be followed?

The size of any modification can vary substantially from a simple but critical, modification to instrumentation, all
the way up to a major brownfield upgrade on an existing platform. While different levels of scrutiny will apply due
to the varying risks, it is essential that a controlled process and authorisation is consistently applied.
Each Duty Holder may have processes in place but they should broadly be in line with the following basic processes:
1. IDENTIFY / INITIATE Change Request
Outline reasons for change, define scope, explain benefits to be gained
Screening by appointed responsible personnel to move to next stage or reject
Define any necessary studies and assessments required for Assess phase
66
2. SELECT
Carry out Management of Change Risk Assessment with relevant technical personnel from operations,
maintenance and design as necessary. This should include a suitable depth of review of relevant risks and
identification of mitigation measures to be used. The residual risk should be established and a decision to
progress or reject proposal should be formulated with a record of the risk assessment and agreed actions
3. DEFINE Scope of work and detailed design
4. EXECUTE construction and commissioning
Complete Management of Change close out records
5. CLOSE OUT / OPERATE
Review the change that has occurred
Capture Lessons Learned
Formally record changes on company controlled documents
How do we complete Assurance and Verification of MOC?

For modifications to SCEs, it is essential that there is review by the Duty Holder, normally through the relevant
Technical Authorities, and a level of Verification by the ICP to ensure that SCEs are suitable for use following
the completion of modifications. The extent of Verification may vary according to the complexity of change and
this should involve a staged process of review to ensure that modifications are correctly selected, developed and
executed; it may be defined that the extent of modification is suitable that verification may be carried out upon
completion (ie by workpack review) but this needs to be agreed with ICP by the same engagement at the
early stage of the change. The stage-gate approach assures an efficient and effective process and, by screening
errors or omissions at an early stage, avoids rework and wasted effort and supports continued suitability of SCEs.
Verification can provide measurable added value in projects by early identifying of costly errors.
Assurance and Verification of Modifications to SCEs
1
IDENTIFY
Engineering
Deliverable
Assurance /
Verification
Deliverable
Proforma with
problem statement.
2
SELECT
3
DEFINE
4
EXECUTE
Review of
solutions with
detail on selected
option, including
identification of
hazards and risk
assessment.
Detailed Engineering
Work-pack for
selected option.
Execution of
Construction and
commissioning
activities. Develop
Certification pack.
Review by Assurance
/ Verification for
conformance to
Duty-holder
Review of work-pack
prior to execution
to ensure continued
adherence to original
concept, standards,
etc.
Review and issue of

release note prior to
bringing equipment
into service to
ensure compliance
with original design
intent, standards,
etc.
OPERATE
Figure 8
All sections of this document provide further text on recommended activities to support Management of Change
and these should be referenced when reviewing change proposals.
67
11. TEMPORARY EQUIPMENT EQUIPMENT REQUIRED

OFFSHORE FOR A SHORT PERIOD
Introduction
Temporary Equipment may introduce an additional hazard, or adversely affect existing SCEs. Identification of the
hazards and risks exposed by Temporary Equipment is required to reduce the potential for major accidents. An
effective Temporary Equipment procedure will improve safety levels, downtime and product quality, Regulatory
compliance, environmental performance and preserve company reputation. The Duty Holder needs effective
Assurance and Verification processes to ensure suitability of Safety Critical Temporary Equipment as required under
the Safety Case Regulations.
What can go wrong with Temporary Equipment?

To illustrate the importance of having a robust process for managing Temporary Equipment and ensuring that it is
rigorously applied, an example of a real event has been included:
A temporary flexible flowline and choke manifold suffered failure of the hose due to sand erosion. The temporary
line had been routed through an open door to an adjacent module allowing flammable gases to migrate outside
of the working module following hose failure. A HAZOP had been conducted but failed to note the presence of
flow straightening vanes (thought to have been a contributor to the failure) which were not shown on the relevant
drawings used onshore for the HAZOP.
[Issues: Documentation not maintained to current status; impairment of barriers to gas migration (open door);
questionable representation on the onshore HAZOP team - would local site knowledge of, or visit to, installed
facilities have identified the presence of flow straightening vanes?]
[Source HSE SPC/TECH/OSD/25]
This is one simple example but it illustrates why Temporary Equipment needs to be controlled by the application of
a consistent procedure, correctly engineered and subject to review by authorised persons before and during use.
What is Safety Critical Temporary Equipment?

While each Duty Holder may have a different definition for this, a typical definition of what constitutes Safety
Critical Temporary Equipment is essential, and this can take the form of the following:
The term safety-critical elements (SCEs) is an important component of the provisions relating to
Verification Schemes see SCR regulation 2(5). Any structure, plant, equipment, system (including
computer software) or component part whose failure could cause or contribute substantially to a major
accident is safety critical, as is any which is intended to prevent or limit the effect of a major accident.
Temporary Equipment comprises equipment that is not a permanent part of the installation and which
it is intended should be removed after a finite period of time. [Source HSE SPC/TECH/OSD/25-Version 3]
68

The table below contains examples of Temporary Equipment that will likely be considered Safety Critical, their
relation to a MAH, SCEs that they would directly impact and SCEs that they could potentially impact upon:
Item
MAH
SCE
(direct impact)
SCE
(potential impact)
Chiksan Piping
Release of Hydrocarbons
Hydrocarbon
Containment
F&G Detection
Escape Routes
Firewater
Zone II Air Compressor
Fire or Explosion
Ignition Prevention
F&G Detection
Escape Routes
Emergency Shutdown
Slickline BOP
Release of Hydrocarbons
Hydrocarbon
Containment
ESD Reservoir Isolation
F&G Detection
ESD System
Who should be involved in the Control of Temporary Equipment?

Duty Holders should develop an Assurance process and associated procedures for the Management of Temporary
Equipment. This should define key roles and responsibilities, typically including:
Engineers calling off equipment
Safety Engineers and Technical Authorities to assist in the identification of Safety Critical Equipment and their
associated Performance Standards
Vendors in the supply of equipment
QA / Engineers / Inspection Companies / Warehouse and quayside personnel to assure supplied equipment
meets the Specification / Performance Standard
Platform personnel
Assurance of Temporary Equipment

Duty Holders must assure that any Temporary Equipment on their installation is suitable. An assessment needs
to be made to identify if the equipment is Safety Critical. Where Temporary Equipment is identified as Safety
Critical, it must meet the Duty Holders Performance Standards and this must be assured by the Duty Holder.
A typical process to ensure Temporary Equipment is adequately controlled may involve the following activities:
Identification of requirement to assess the risk and specify the equipment
Provide equipment to meet specification
Assure equipment meets specification and Performance Standard prior to shipment. This can be achieved
through inspection, testing and / or review of records
Receive equipment offshore, check for transit damage, confirm suitability for hook-up at location and ensure
controls are in place
Ongoing Assurance of continued suitability while onboard and in use
69

Specific items to consider for the Control of Temporary Equipment

Duty Holders should define a time limit for Temporary Equipment. Any Temporary Equipment which exceeds
this limit should be removed from service or alternatively, considered permanent, where it needs to go through a
formal Management of Change process.
When bringing any Temporary Equipment onboard, an assessment should be made of its impact on existing SCEs,
eg. will the equipment block escape routes, flame detectors, deluge nozzles etc.
Where Duty Holders have large load-outs of Temporary Equipment with multiple tie-ins to platform systems, they
may opt to use their Management of Change process to control their Temporary Equipment.
For Drilling and Combined Operations, responsibility for Assurance and Verification should be agreed between all
parties. This should be detailed in bridging documents that clearly define roles and responsibilities.
Verification of Temporary Equipment

The Verification process must be independent from the Assurance process previously described.
The Duty Holders Verification Scheme must document the ICPs Verification activities in terms of Nature and
Frequency for Safety Critical
Temporary Equipment:
Nature Describes what the ICP will do. Essentially, the ICP should verify the Duty Holders Assurance process
for the Control of Temporary Equipment. This can be done through auditing the process and may involve
examination / review of documentation / witness of certain activities both onshore and offshore. When the ICP
conducts their Verification, it is important that it is pro-active and therefore requires them to be involved at the
beginning of the Assurance process and follow it through
Frequency Describes how much the ICP will do. This is difficult to document but essentially the ICP should not
be looking at every load-out of Temporary Equipment but they should take a representative sample and ensure
they have verified the process from start to finish
If, during the Verification activities, the ICP raises any Findings, these should be brought to the Duty Holders
immediate attention for consideration before the Temporary Equipment is put into operation.
70

Step
Activity
Guidance
Comment
Define company
minimum
requirements
for Temporary
Equipment
Typical aspects that need to be considered before the

module is sent offshore are:
What are the Duty Holders Performance Standard requirements?

What external codes or standards meet or exceed these requirements?
What EC Directives does the equipment need to comply with?
Advise suppliers in a timely manner of these requirements and have them
agreed within contracts
See also DNV Offshore Technical Guidance OTG-05 (add URL link)
System Footprint
Deck loading
Fire protection structural and active
Hazardous areas created / located
Escape routes that will be affected
Utilities / Supplies
Electrical main and emergency
Hydraulic
Pneumatic
Water potable and cooling
Return Aspects
Routing of pressure relief systems
Drainage
Thermal load
Contamination of systems
Earthing
Safety Issues
ESD interfaces or impacts
Additional Hot surfaces
Communications
Impact to existing Escape Routes
Fire & Gas interfaces or impacts
Ventilation (blocking natural ventilation or
contaminating safe area supplies)
Emergency Lighting (additional requirements or
impairment of existing provision)
71

Step
Activity
Guidance
Comment
Specify individual
Temporary Equipment
requirements
What is required?
Engage with installation personnel to ensure correct equipment is specified

for the intended purpose and location it is to be used
Identify responsibility for installation, operation and maintenance of the
equipment whilst onboard and its removal
How long is it required for?

Where will it be used? - Is that location a Hazardous
Area? Are there any deck loading issues?
Who will be responsible for the equipment while it is
onboard? (Performing Authority)
Who may be affected by the equipment's location or
use? (Area Authority)
Identify interfaces with installation systems
- Does the equipment need to be connected to Fire & Identify the testing and inspection requirements for these interfaces
Gas / ESD systems?
- What utilities are required?
- How are these to be connected?
- Is the equipment compatible with the process it is
being connected to? (Piping Specification)
72
Identify any maintenance or inspection requirements
Engage with supplier to identify any maintenance required
Are there any operating or safety instructions

required?
Engage with supplier to identify any particular safety precautions to be

observed
Is further operator training needed?
Engage with supplier to identify any specific operator competence or

additional training required
Is the equipment noisy? Do levels exceed the Duty

Holder's noise limits?
Identify further mitigation measures if required

Step
Activity
Guidance
Comment
Assess impact on the site
Does the equipment introduce a new Hazard?
Involve the right people in this assessment.
Will it put an excessive demand on existing SCEs (eg

structures, deluge, UPS etc)
Will it adversely affect existing SCEs (eg obstruct deluge
nozzles, fire detectors, escape routes, degrade emergency
communications, restrict space in muster etc)
Is the equipment Safety Critical? What are the
Performance Standard requirements?
Finalise the exact specification of equipment to ensure it
is suitable given the potential hazards identified
Identify any additional measures or mitigation required
to control the hazards while the equipment is onboard ensure these are communicated to the Area Authority
4
Review / Approve
Duty Holders may wish to formally review or approve the

specification before equipment is mobilised
Particularly relevant where the equipment is specified by a client or

other third party and not the Duty Holder
Procure Temporary
Equipment
Ensure the required specification (certification,

connections) is communicated to the supplier
It may be useful to include these requirements within contracts or

bridging documents
Duty Holder to assure that Temporary Equipment meets

the Performance Standard prior to shipment.
Review documentation certification, EC Declarations of Conformity,

maintenance records, lifting certs, NDE certs, function test reports,
pressure test certs, zone rating certs, attend tests
Ship and receive on the

installation
Preparations Before Use
Inspect equipment upon receipt - confirm it matches what Review documentation certification, EC Declarations of Conformity,
was requested and is in good condition
maintenance records etc
Document the arrival of Temporary Equipment onboard
(Register of Temporary Equipment) and log date it is due
off
Monitor this document to ensure maximum allowable period is not

exceeded
Confirm there has been no damage in transit
Engage with SMEs as required (Mech, Elec, Inst, Tcom) etc
Confirm all necessary maintenance / operations and

safety instructions have been supplied
73

Step
Activity
Guidance
Comment
Review the Site Impact Assessments (including PUWER &

COSHH etc)
Review documentation and ensure any limitations,
comments or controls are included in the permit
Ensure any additional mitigation measures are understood
and complied with
Implement noise control measures as required
Ensure equipment is located in the designated area
Refer to Weight Control procedures and Area Classification drawings
Connect to installation utilities and protection systems

- Proof test Fire & Gas / ESD interfaces, leak test process
connections
Retain documentation of any inspection / testing carried out
Assess any other impacted SCEs and implement

appropriate mitigation measures
Such as Escape routes or vent paths blocked, fire detection/fire

protection systems impaired etc
Operate the Temporary

Equipment under PTW
control
Maintain, inspect and operate Temporary Equipment in

accordance with the defined requirements
Remove Temporary
Equipment
Isolate, disconnect and prepare equipment for backload

Reinstate permanent plant affected by Temporary
Equipment to safe condition
Remove Temporary Equipment from area
Update the Register of Temporary Equipment
Backload equipment to shore and return to supplier
74
Consider any cleaning or decontamination that may be required
APPENDIX 1

Example 1
1. Provide a single sentence summarising the
relevant System and Issue
ICP identifies significant improvements to Duty
Holders SCE Assurance Process.
2. Describe the problem and how Verification
identified this
Issue
Through a robust Operational Verification Scheme,
the ICP was instructed to thoroughly scrutinise the
SCE Assurance Process for all identified SCEs. Through
this process, the ICP identified several areas where
the SCE Assurance Process was not suitable and as a
result escalated the issue by combining the individual
issues and raised a high level Finding that allowed the
Duty Holder to investigate and implement an Effective
Solution.
Examples
Fire Fighting (Automatic and Manual) and Life Saving
Apparatus Assurance Process was not suitable due to:
Poorly defined Performance Standards
Assurance activities did not assure against the
Vendor had no visibility of Performance Standard
Vendor Assurance records were poor and not visible
in Duty Holders Maintenance Management System
(MMS)
Follow-up of Safety Critical Remedial work was not
auditable
Hazardous Area Electrical Equipment Assurance Process
was not suitable due to:
Poor HAE Strategy
Poorly managed inspections: Equipment not being
inspected as per plan
Variable Competency
Exact Quantity of HAE items unknown.
Poor recording of newly installed equipment.
Resourcing not well managed to execute workload
Improvements made
Fire Fighting (Automatic and Manual) and Life Saving
Apparatus Assurance Process:
Performance Standards improved
Assurance activities aligned to Performance
Standards
Assurance activities embedded in Duty Holders
MMS.
Communication with Vendor improved
History of Assurance activities improved
Remedial work clearly recorded in Duty Holders
MMS.
Hazardous Area Electrical Equipment Assurance
Process:
New HAE Philosophy written and issued
Duty Holder site audits implemented to assess
effectiveness and competency of inspections
Specific HAE onshore resource appointed
Complete review and rescheduling to aid efficient
inspections
Manning levels better understood
Benefits
HAE inspections being competently inspected in the
most efficient manner, resulting in confidence of
HAE Integrity
Cost saving as retrospective campaigns to liquidate
backlog avoided
Cost saving as Integrity issues identified early and
potentially resolved within normal outages, thus
avoiding potential shutdowns for replacement of
critical equipment
Legal Compliance maintained
Reputation secured
3. Explain the potential consequences which
may have arisen should Verification not have
identified the Issue
HAE integrity would have been compromised and
therefore the potential for ignition resulting in a
Major Accident and potentially leading to fatalities
would increase
Improvement Notice from HSE
Potential for shutdown until SCEs were compliant,
resulting in loss of production
75
APPENDIX 1

Example 2
For Engineering Changes, the Duty Holder was unable
to demonstrate that suitable Assurance Processes were
in place to manage SCEs and their associated
Performance Standards.
identified this
Issue
Assurance Process by the Engineering Contractor
(EC) did not suitably show SCEs and their associated
Performance Standards had been assured. This resulted
in SCEs not meeting their Performance Standards.
Through the Activities documented in the Verification
Scheme for Projects and Modifications, the ICP
identified several instances where SCEs were not
meeting their Performance Standards. Examples were:
Emergency Lighting designed / procured and tested
for 90 min duration when Performance Standard
was 120min
HVAC designed to 6 air changes/hr when
Performance Standard was 12 air changes/hr
Electrical Cabling designed / procured and installed
to incorrect fire protection rating
No Technical Deviations were raised by the EC.
ICP escalated the issue by combining the individual
issues and raised a high level Finding that allowed the
Duty Holder to investigate and implement an effective
solution.
Improvements made
Improvements to EC Assurance Process so that
SCE Performance Standards were clearly assured at
Design, Procurement, Construction, Commissioning
and Handover. For example:
1) Design Engineers signing to confirm they had met
the identified SCE Performance Standards for each
Modification / Project
2) Commissioning identifying all the SCE Performance
Standards up-front, and documenting which
76
Offshore Test Procedures would assure that

Process improved for ensuring the EC had current
Performance Standards
Communication with ICP improved
Benefits
Increased confidence that SCEs will work as intended
when required
It is more cost effective to meet the Performance
Standard before handover than to retrospectively
engineer solutions to meet the Performance
Standard
Legal compliance maintained
Reputation secured
identified the Issue.
SCEs would not have been effective during a Major
Accident resulting in an escalation of the event and
potentially leading to fatalities
Improvement Notice from HSE
Potential for shutdown until SCEs were compliant,
resulting in loss of production
APPENDIX 1

Example 3
ICP identifies significant fault in a SIL 3 rated Safety
Critical system in which over pressure of an interfiled
pipeline was possible.
identified this
Issue
During function testing of an Interfield pipeline Over
Pressure Protection System, (OPPS), it was noted by the
Verifier that there was a fault with one of the pipeline
pressure sensor control system cards for the OPPS. On
investigation of the internal cards it was found that
the analogue input card in slot 1 was indicating a fault
signified by a Light Emitting Diode, (LED) 1 flashing.
The card was also showing a green healthy LED as per
the other cards installed in slots 2 and 3 which are for
the other 2 pressure sensors. The fault state was not
transmitted to either the matrix panel or Integrated
Control Safety System, (ICSS), screens for operator
attention, therefore for some unknown period of time
the OPPS had been operating at a lower integrity,
2 out of 2, (2oo2) voting system.
amended to ensure more regular checks completed

Remote alarm warning system implemented to
allow the status of the cards to be monitored from
the control room which is on a manned platform
several kilometres away
Benefits
Performance Standard availability and reliability
remains assured and therefore legal compliance
maintained
Integrity of SIL rated system now much more robust
Reduction in risk of overpressure situation arising
undetected
Reputation secured
identified the Issue.
Overpressure situation within Interfield pipeline
causing catastrophic event at unmanned platform.
Multiple fatalities a possibility
Huge environmental situation which is very hard
to control due to ruptured subsea pipeline. Far
reaching and large scale pollution
Large Production loss
Worldwide media, public scrutiny and criticism
If there are no methods by which to inform the Control

Room Operators on the ICSS or the matrix panel then
it is possible that 2 of the 3 cards may be in fault but
the system would still be operating at a 2oo3 voting
system. This has catastrophic potential as all 3 PTs
could be showing overpressure but the Emergency
Shutdown (ESD) System would only see the 1oo3
overpressure signal and no executive actions would be
taken. The cards were located on a normally unmanned
installation which made the ad-hoc discovery of the
fault more unlikely.
Improvements made
New cards provided by manufacturer which allow
voting to be decreased to 1oo2 should there be any
equipment failure, thus maintaining the integrity of
the system
Regular inspection of the lamps on the control panel
in which the control cards are located. PM frequency
77
address
3rd Floor

The Exchange 2

62 Market Street
Aberdeen

AB11 5PJ
telephone
01224 577268
email info@stepchangeinsafety.net
website www.stepchangeinsafety.net
designed by foyer graphics
Annual Review 2010

1383

Uploaded by

Copyright:

Available Formats

1383

Uploaded by

Document Information

Original Description:

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

1383

Uploaded by

Copyright:

Available Formats

What challenges do workers face in the offshore oil and gas industry?

What challenges do workers face in the offshore oil and gas industry?

What safety legislation was introduced following the Piper Alpha disaster?

What safety legislation was introduced following the Piper Alpha disaster?

3

ASSURANCE & VERIFICATION

Making the UK the

Step Change in Safety - Assurance & Verification Practitioners Guide

Step Change in Safety - Assurance & Verification Practitioners Guide

Step Change in Safety - Assurance & Verification Practitioners Guide

TERMS, ABBREVIATIONS AND REFERENCES

INTRODUCTION, SCOPE AND OBJECTIVES

MANAGING MAJOR ACCIDENT HAZARDS THROUGH BARRIERS

ASSURANCE AND INTEGRITY MANAGEMENT

VERIFICATION - SUPPORTING THE ASSURANCE PROCESS

VERIFICATION - RELATIONSHIPS AND COMMUNICATION

TRAINING, COMPETENCE AND ROLES AND RESPONSIBILITIES

10. MANAGEMENT OF CHANGE

11. TEMPORARY EQUIPMENT EQUIPMENT REQUIRED OFFSHORE FOR A SHORT PERIOD

Examples of Verification Benefits

Step Change in Safety - Assurance & Verification Practitioners Guide

TERMS, ABBREVIATIONS AND REFERENCES

Terms and Abbreviations

Approved Code of Practice

Step Change in Safety - Assurance & Verification Practitioners Guide

TERMS, ABBREVIATIONS AND REFERENCES

known as ATEX 95)

Directive 94/9/EC The ATEX Equipment Directive (also

Step Change in Safety - Assurance & Verification Practitioners Guide

2. INTRODUCTION, SCOPE AND OBJECTIVES

The Offshore Installations (Safety Case) Regulations

Offshore Installations and Pipeline Works

Prevention of Fire and Explosion and Emergency

Step Change in Safety - Assurance & Verification Practitioners Guide

2. INTRODUCTION, SCOPE AND OBJECTIVES

Step Change in Safety - Assurance & Verification Practitioners Guide

2. INTRODUCTION, SCOPE AND OBJECTIVES

Improving understanding of MAH barriers related to SCEs

Clarifying the Assurance and Verification processes to all industry personnel

Step Change in Safety - Assurance & Verification Practitioners Guide

The Offshore Installations (Safety Case) Regulations (OSCR)

Step Change in Safety - Assurance & Verification Practitioners Guide

The Verification Scheme is in place and operating as required

Step Change in Safety - Assurance & Verification Practitioners Guide

Major Accidents Hazard Management overview

Safety Critical Elements (SCEs)

Step Change in Safety - Assurance & Verification Practitioners Guide

Identification of Safety Critical Elements

Safety Critical Elements & Sub Elements

Ex. Certified Equip.

Figure 2 - Identification of Safety Critical Elements

Process Shutdown System

Water Fire Fighting HVAC

Turbine for Compressors

Well Control &

Well and Components e.g.

Step Change in Safety - Assurance & Verification Practitioners Guide

Figure 3 - Major Accident Hazard Management

Step Change in Safety - Assurance & Verification Practitioners Guide