Professional Documents
Culture Documents
Integrity Management of Safety Critical Equipment and Systems
Integrity Management of Safety Critical Equipment and Systems
Systems
Life-cycle approach to integrity management
Hazards & Effects Management process is a formal framework that was introduced in the
late 1980s as a methodology to identify hazards, determine and manage risks. As part of
the Hazards & Effects Management process, the duty holder needs to identify HSE
Critical Equipment & Systems (HSECES), HSE critical activities, HSE critical integrity
activities for the various phases of the project development life cycle.
Oil & Gas operators have established codes and standards that enlist typical HSE critical
equipment and systems; however applying only prescriptive approach is not the intention.
Identification of HSECES should be based on goal setting approach considering
prescriptive approach as a minimum requirement. One of the well-known goal setting
approach currently applied is the ALARP demonstration process, wherein the duty holder
should demonstrate that the risks have been reduced to a level that balances with the
costs, efforts and time required in risk reduction.
A typical HSECES identification flowchart that adopts the prescriptive approach is shown
below:
The above flowchart is a good starting point for identification of Health, Safety &
Environmental Critical Equipment Systems ( HSECES ). The application of this flowchart
should be on the project / asset equipment list, which ensures that the entire asset
inventory has undergone the classification process.
To apply goal setting approach, Health, Safety & Environmental Critical Equipment
Systems ( HSECES ) should be further identified based bowtie methodology. The
bowties should be developed upon finalization of the formal safety studies such as PHA,
Hazard Identification Study ( HAZID ), Quantitative Risk Assessment ( QRA ) , Escape &
Evacuation Study, SIL, Dropped Object Assessment, and Corrosion Risk Assessment.
The bowtie diagram is a useful tool in identifying Health, Safety & Environmental Critical
Equipment Systems ( HSECES ). It starts with defining a top event which is usually the
major concern with respect to a major accident hazard. Examples of top event could be
“loss of containment” or “structural failure”. On the left hand side of the top event are the
threats or causes that lead to the top event. The barriers or threat controls follow the
Swiss Cheese Model and prevent the threats from realizing into the top event. The threat
controls reduce the likelihood of the top event. Should the integrity of the barriers be lost,
the threats can penetrate and lead to the top event. On the right hand side of the top
event are the consequences. The recovery preparedness measures reduce the severity
of the consequence. If the integrity of the recovery preparedness measures are lost, the
consequences can escalate leading to increased severity. Loss of barrier is termed as
escalation and escalation factor controls reduce the likelihood of escalation.
The threat controls, recovery preparedness measures and escalation factor controls are
Health, Safety & Environmental Critical Equipment Systems ( HSECES ) or HSE critical
activities based on their type. The prescriptive list of Health, Safety & Environmental
Critical Equipment Systems ( HSECES ) will be part of some of the controls in the bowtie
diagram. The complete list is only expected to arrive from the goal setting approach.
Applying the goal setting approach will answer the following questions:
Are the integrity requirements of HSECESs appropriate? and will they ensure that the HSECES
will function as intended in an event of major accident?
HSE Critical Integrity activities are the design, construction, installation, commissioning,
operation, modification, repair, inspection, testing or examination activities associated
with assuring the integrity of an Health, Safety & Environmental Critical Equipment
Systems ( HSECES ). These activities are different for each phase of the project.
The figure above presents a general approach adopted in identifying the HSE Critical
Integrity activities for each project phase. The activities associated with each of these
phases are discussed in subsequent chapters.
Design is the first and the last opportunity to introduce inherently safe concepts and built
in quality. The following design HSE Critical Integrity activities are suggested as
examples:
HSE Audits:
To ensure that the HSECES Management System is functioning as intended, internal /
external audits should be undertaken during the design stage. The HSE Audits can help
in identifying shortfalls that can be closed prior to closure of the project phase.
Integrity Activities
This phase is associated with the HSE Critical Integrity activities associated with
Procurement, Fabrication, Receiving at Site, Storage and Retrieval, Construction and
Installation and Commissioning. The following design HSE Critical Integrity activities are
suggested as examples:
The quality assurance activities associated with the operation phase include operation
itself including maintenance, use of temporary equipment, in-service repairs, alterations
and rerating, use of spare parts.
HSE Critical Integrity Activities need to defined for decommissioning phase in case any of
the below statements are true:
Will the removal of HSECES affect other operational HSECESs in the plant / facility?
Will the failure of the decommissioned HSECES adversely affect personnel health and safety,
assets and environment?
The quality assurance activities associated with decommissioning phase include risk assessment
for mothballing, draining, purging, storage and re-commissioning.
In the case of preventative measures (controls on the left hand side of the bowtie), these
will be the parameters that are examined or measured to assure the integrity. For
detection, control and mitigation measures (recovery preparedness measures on the
right hand side of the bowtie), they will be parameters that demonstrate that the system
has fulfilled its role in limiting the effects of the major accident event.
Functionality;
Survivability; and
Reliability:
Reliability is defined as the required probability that the Health, Safety & Environmental
Critical Equipment Systems ( HSECES ) will operate on demand where required to
maintain integrity.
Availability:
Availability is defined as the extent to which the Health, Safety & Environmental Critical
Equipment Systems ( HSECES ) is required in order to retain its functional integrity.
Survivability:
Survivability defines the external loading events associated with a major accident event
against which the HSECES is required to retain its functional integrity.
The performance standards include all the criteria that that HSE Critical Integrity activities
need to meet against which the HSECES are verified or tested during each phase of the
project.
The first challenge is to identify all the HSECESs in the facility. The process that is
suggested in this paper prefers a combination of prescriptive and goal setting approach.
A challenge encountered by the authors in applying this methodology is to avoid non-
HSECES related equipment or system to be classified as HSECES. It has been felt that
during bowtie workshops, several non-HSECES related equipment & systems get
classified as HSECES and thereby dilute the importance of HSECES. This can only
achieved by establishing smart rules and through brainstorming sessions.
Another challenge faced by the authors is to link existing HSECES and Performance
Standards with new HSECES and their Performance Standards. In brownfield projects, it
is quite likely that existing systems are not classified as HSECES. This creates a problem
when there are links between new and existing facility (eg. Structural modifications, new
instrumentation linked to old instrumentation, process modifications). It is suggested that
operating sites should identify existing HSECES and develop performance standards so
that the HSE Critical Integrity can be defined during modification stages.
It is important that Designers are involved in identification of HSECES and aware of the
HSECES during the early design stage. This helps in avoiding potential noncompliance
with design performance standards that are established later on.