NEW SAFETY RULES CHALLENGE U.K. OPERATORS, REGULATORS

Jon Hudson
Health & Safety Executive
Liverpool, U.K.

Offshore safety regulations based on lessons learned from the Piper Alpha blast of 1988 have been in operation in the U.K. for a year.

The Offshore Installations (Safety Case) Regulations 1992 make operators of fixed and mobile installations (the "duty holders") responsible for producing a formal safety assessment, or safety case, for each installation. 1

After the end of November 1995 it will be an offense to operate an installation without a safety case which has been approved by the government's Health and Safety Executive (HSE).

Producing safety cases for installations is a major task for duty holders, while assessing them is a huge undertaking for HSE's Offshore Safety Division (OSD).

Now is an appropriate time to review how HSE has established management arrangements to handle safety cases, consider progress in assessment, highlight some of the important lessons learned, and look to the future.

HSES APPROACH

The value of total quality concepts for safety case handling and assessment was recognized at an early stage. Our assessment procedures have been prepared in accordance with ISO 9000 international standards. Initial system audit and compliance audits have been undertaken. Both have identified opportunities for improvements in our approach.

A review mechanism monitors performance continuously. Where improvement opportunities are identified, quality improvement teams (QlTs) are established, involving staff who actually carry out assessment work. QlTs work to a written project specification with agreed deliverables and timescales.

HSE wishes to be open in its dealings with industry, so at the outset we agreed on performance standards for achieving milestones with industry, and a memorandum of understanding was signed. A description of the commitments made by HSE and of details of the process of assessment was published in November 1993 as the "Guide to Offshore Safety Case Assessment." 2

To ensure that the complex process of assessment goes as smoothly as possible, central approaches have been made to coordinate and resolve problems between industry and HSE. A senior managers' forum is held every 2 months, where industry and HSE discuss safety case issues.

ASSESSMENT

The assessment process involves two stages.

Stage one is an initial screen of the case to ensure that it contains sufficient information to permit detailed assessment. Stage two is a detailed assessment against the requirements of the regulations. This is carried out by topic assessors managed by a case manager.

The primary means of resolving queries arising from HSE's assessment is discussion between OSD's inspectors and the duty holder. However, when an issue is identified that could have a bearing on HSE's acceptance of the case, this is raised with the duty holder at the earliest opportunity on an "issue note."

In no instance will a safety case be rejected without the duty holder's having first had the opportunity to resolve the matter raised in an issue note.

During assessment, issues may be identified which warrant follow-up, and some may highlight the need for new technical guidance or even research. Many issues will be installation-specific, but some will have wider implications.

At the end of assessment the case manager recommends acceptance or rejection of the case based on the duty holder's responses to the issues raised. The decision is communicated in writing to the duty holder and the workforce.

DEADLINE

Our major task is to ensure that the assessment of all safety cases for existing fixed and mobile installations is completed by the end of November 1995. After this date it will be an offense to operate an installation without an accepted safety case. There are in excess of 210 cases of this type.

In addition, we expect a further dozen or so design and abandonment cases to be submitted each year, and there will be further cases for combined operations and major modifications. Eventually, there will also be cases resubmitted as part of the 3 year review process.

To coordinate the overall program of assessment, work on each case is scheduled on an overall project plan defining timescales and resource allocation. The plan aims to smooth our workload through the period to November 1995.

To enable both industry and HSE to share the early lessons of assessment, 64 cases were chosen, with industry agreement, as exemplars, with assessment starting as early as possible in the program. This ensured that each company had early experience of having safety cases assessed.

After completion of assessment of an exemplar, the duty holder is asked to incorporate any relevant lessons learned into the nonexemplar cases before they are subject to detailed assessment. This will raise efficiency in assessment of nonexemplars, especially for installations and more particularly mobile units, which are very similar.

PROGRESS

Current progress with safety case assessment is shown in the table.

At least one of each of the main installation types has been accepted, although the completion figures represent approximately 50% progress against our overall plan.

The number of completions does not fully represent the extent of our assessment progress, as a significant number of cases currently await resolution of technical issues in one or two topic areas only.

Internal milestones are set for the completion of assessment by each topic area on each safety case. At June 30, the completion rate for internal milestones was 86%. This figure has increased for the past 6 months.

HSE's experience to date falls into two categories: the assessment process and program, and technical issues arising out of assessment.

We were overassessing and in some cases duplicating assessors' time on similar issues. We have improved this situation by better focusing our efforts and improving communications both internally and with duty holders.

Many matters were raised initially through use of the issue note system. This led to a plethora of paperwork and, inevitably, to some confusion.

Now key issues are raised informally with the duty holder by telephone, letter, or meeting. After discussion, unresolved issues are sent formally to the duty holder via the issue note system. This both streamlines the process and reduces paperwork.

Training workshops have been held to strengthen the understanding of assessment staff of their respective roles and to provide inputs to the improvement process.

TECHNICAL ISSUES

The exemplar exercise has identified issues common to a number of cases.

Safety cases need to make a dear link between all of the elements in the demonstration of safety. The thread must run from hazard identification and analysis, through risk assessment, to an improvement program based on the analysis. The safety case must show that risk is, or will be, as low as is reasonably practicable (Alarp).

Many cases do not show the links between elements, due in part to different sections of the cases being prepared by different people, including consultants. Without the links' being in place it is difficult, if not impossible, for duty holders to demonstrate Alarp features.

The regulations require for certain defined risks "suitable and sufficient" quantified risk assessment (QRA). The qualification suitable and sufficient is in the regulations to allow duty holders to make the case they think appropriate. Duty holders have been unsure as to the extent of the QRA needed, with some even interpreting the qualification as meaning none.

The emphasis on risk to the temporary refuge (TR) in the U.K. Regulations Guidance has not caused duty holders to focus only on the TR. Most duty holders have embraced QRA on a much wider scale and have seen the benefits in doing so when prioritizing risk reduction measures and demonstrating the Alarp principle.

STANDARDS

Performance standards can be set at various levels.

They can be risk or goal-based, scenario-based, or system-based and be qualitative or quantitative, depending on their application. They are an integral part of a safety management system (SMS).

There are difficulties in identifying performance standards in terms of systems, as many existing codes and standards relate mainly to components. Also, existing standards are not necessarily risk-based.

In many safety cases performance standards have not been dearly identified, particularly for systems which are safety-critical.

Also, the criteria used to assess fatalities have not been standardized. This relates particularly to heat flux, blast overpressure, and smoke concentration issues, where there is a wide variation in what duty holders consider to be appropriate hazard levels and exposure times.

IMPROVEMENTS

One of the most important areas of a safety case is the improvement program, which defines the duty holder's commitment to implementing risk reductions identified in the safety case.

Examples of common areas for improvement are active and passive fire protection; depressurization and isolation; emergency systems; fire and gas detection; heating, ventilating, and air conditioning (HVAC) systems; emergency equipment location; and refinement of risk studies.

Improvement programs also specify continuous improvement measures as part of the SMS and often include modifications to the case itself.

An integrated approach is needed to reduce risks to Alarp levels. For example, on older installations a satisfactory temporary refuge might only be achieved by a combination of hardware improvements and SMS changes. Improvements in passive fire protection and HVAC systems may need to be accompanied by a reduction of process inventories and better shutdown systems. Even then, SMS enhancements may be required, for example, to ensure down-manning at times of high risk activity and reduction in hot work.

Some early cases did not demonstrate an integrated approach with respect to TR impairment. Analyses showed risk levels which were not Alarp, and the safety cases attempted to justify the situation by the use of self-contained breathing apparatus following a major fire.

OSD has also checked that key measures in improvement programs are adequate and will be implemented in a timely fashion. Special consideration may need to be given to temporary measures in place before full, permanent, integrated solutions are implemented. In one case, a duty holder has chosen to take part of the installation accommodation out of use pending major upgrade, providing a bridge- linked floating accommodation platform until the work is completed.

THE FUTURE

Formal assessment and subsequent acceptance of the safety case are the initial steps of an ongoing appraisal process. Significant issues identified during the assessment phase will be subject to continuing review as part of the program of postacceptance inspection.

This will focus on a comparison of the case made for safety with on-site performance and implementation of the improvement program. Where risk reduction measures involve SMS solutions, inspection will establish whether the claimed measures are being correctly implemented.

This approach to inspection is still being developed, but already there are some interesting examples.

In one instance, the accepted case was found to describe a situation which did not exist. The case claimed credit for explosion relief based on the original drawings. Over the years the installation had been modified and a new plant installed, which brought into question the risk conclusions of the case.

Other postacceptance work arising from safety cases will need handling on a central basis.

One example is ship collision risk. Individual cases are identifying that risks are significant. However, the quantification models are of limited precision, and there is no straightforward solution to reduce risk. HSE is discussing this issue centrally and carrying out a national inspection project. More research will probably be needed in this area.

Industry has worked hard and incurred considerable financial expenditure in preparing safety cases. Duty holders are adopting a positive attitude to the risk-based approach required by the regulations. Early evidence is that this is leading to significant improvements in offshore safety.

With continued cooperation between HSE and industry, all the early signs suggest that the assessment process for the cases for existing installations will be completed successfully by the due date of Nov. 30, 1995. Then we can look forward to the new challenges that postacceptance work will pose.

REFERENCES

A guide to the Offshore Installations (Safety Case) Regulations 1992, HSE Books, ISBN 0 11 882055 9.
Guide to Offshore Safety Case Assessment, HSE Offshore Safety Division, November 1993.