fire process safety newsletter 4th quarter 2012

8/17/2019 Fire Process Safety Newsletter 4th Quarter 2012

1/15

1

Table of Contents

Recognizing Process Hazards and Latent Conditions 1

Inherent Hazards in Hydrostatic Testing 4

Designing Procedures for the Performer 5

Organizational Capability Process Safety ProgramProof of Concept Underway 6

Process Safety – Increase Your Fluency in 2013 7

Gas Detector Location Guidance 8

LPG BLEVE Emergency Response GuidanceDocument Developed 9

Risk Reduction Unless Unreaonable Meansof Deomonstration 11

What’s wrong with this picture? 13

Team Members 14

FIRE AND PROCESS SAFETYNEWSLETTER

4th Quarter 2012

Recognizing Process Hazardsand Latent Conditions

Field visits, or walkabouts, are a common tool usedby leaders at all levels to engage the workforce anddemonstrate that OE is a core value. These visitshave typically been used to observe behaviors thatimpact personal safety performance. While thesevisits also provide an opportunity for leaders todemonstrate their commitment to process safetyrisk mitigation, process hazards and the latent

conditions that can potentially lead to seriousprocess incidents are much more difficult torecognize. Finding these potential issues takes adifferent focus and level of rigor when visiting fieldoperations.

Latent conditions can be defined as existingconditions that may lie unrecognized until combinedwith another upset condition (latent condition oractive error) to result in an incident. (Figure 1)

Figure 1


2/15

Fire and Process Safety Newsletter 4th Quarter 2012

Proprietary Information, Authorized Use Only

2

Latent conditions could be the managerialinfluences and social pressures that make up theculture (“the way we do things around here”), whichmay affect the design of equipment or systems, andmay stem from insufficient supervisory oversight.They tend to be hidden until uncovered by an

incident, possibly due to several latent conditionscombining in an unforeseen way.

The goal should be to identify these latentconditions before they can escalate into a potentialprocess safety incident. To do this, we need tochange the way we look at hazards when we go outinto the field. We still have to look for hazards andbehaviors that can impact personal safety, but wemust broaden our search for potential processsafety incidents. The Hazard Identification Tool isgreat for helping identify hazards that can lead topotential immediate and certain safetyconsequences. However, it is harder to use on those

potential future and uncertain scenarios.

Generally, there are four areas of focus to helpidentify potential loss of containment scenariosduring a field walk.

1. Identify the potential source of a loss ofcontainment event.

2. Identify latent conditions that could allow

loss of containment events to escalate into

more severe process safety consequences –

fire, explosion, toxic impact, etc.

3. Review the stewardship of our safeguards(both preventive and mitigative) – are they

still effective?

4. Identify non-process safety hazards that

could be a cultural indicator and relate to

process safety as an Operational Discipline

issue.

Potential sources for loss of containment eventshave to be envisioned with the failure of anotherbarrier. In this instance (Figure 2), a block valvewas closed and locked out as part of the Safe WorkPractice preparing this pump location formaintenance. However, the blind flange was not

fully bolted to the piping as required by anapproved standard. If the block valve were to leakor if the lock-out was removed improperly, a loss ofcontainment could occur. The Operational Disciplineto consistently comply with all codes and standardsshould ensure that all bolt holes are utilized toproperly tighten connections, even if the outage istemporary.

Figure 3 highlights the second focus area - potentialescalation of the process safety consequences. Ifthere is a gas release in the area, ignitionprevention measures could stop the scenario fromescalating into a fire or explosion. One suchmeasure is by installing electrical equipment thatcould be a source of ignition in electrically classifiedenclosures with purge systems. These purgesystems act as safeguards that prevent the gasfrom entering and coming into contact with theelectrical equipment that may result in an ignition.

However, those safeguards have to be maintainedin an asset integrity program and checked onthrough routine operator duties. An inadequatepurge by itself is not a problem. But it is a latentcondition that could combine with a gas releasefrom another source leading to a fire or explosion.

Hazard Identification Tool Figure 2


3/15



3

Another common safeguard that requiresstewardship from design and installation throughoperation and maintenance is a Pressure ReliefDevice (PRD). In the picture below (Figure 4), thereappears to be a bushing and a reduced pipe sizeattached to the flange on the outlet of theconventional, spring loaded relief valve. Thisrestriction in the outlet piping could prevent thedevice from effectively relieving the pressure fromthe system it is protecting during a future anduncertain overpressure scenario. Luckily, in thisinstance, the Pre-Startup Safety Review did catch

this installation error before the system was placedin service.

Figure 5 is an example of the last focus areacategory, which is identifying a hazard indicative ofa broader cultural issue. In this case, piping

supports for a water system were inadequatelydesigned or did not follow the appropriate technicalcodes and standards. Effective application ofOperational Discipline for this installation (“There isa lw a y s time to do it right”), would not haveallowed this construction technique in the field. The

workforce must understand that all of ourprocesses, from Facilities Design and Constructionto Management of Change and Asset Integrity, arethere to prevent incidents. Without the operationaldiscipline to effectively execute OE processes, thesetypes of deviations may become normalized whenworking with other more hazardous materials.

So in review, what can be done to identify thesetypes of issues / conditions?

Understand what a Latent Condition is and

its role in potentially leading to an incident;

Actively look for inappropriate application of

technical codes and standards in the field;

and

Challenge/verify the effectiveness of

safeguards

If latent conditions with a potential process safetyimpact are found, consider sharing them with ETCHES Safety Technology Unit for potential inclusionin this newsletter. Better understanding andidentification of latent conditions will drive increasedprocess safety performance across the Enterprise.

Mike Kelly

Figure 3

Figure 5

Figure 4


4/15



4

Inherent Hazards inHydrostatic TestingHydrostatic testing (hydro-testing) is performed to

assess the fitness for service conditions of vessels,piping and pipe components, and is performedsafely thousands of times a year. Duringhydrostatic testing, energy (in the form of pressure)is added to the system at elevated levels. Normallythis energy is safely contained within the equipmentresulting in a successful test. Occasionally thehydro-test will fail due to anomalies in design,manufacturing, or incorrectly assembledconnections. This type of failure usually shows upas a leak. However, a hydro-test can result in acatastrophic failure with a sudden release of energy,placing personnel in danger. Injuries and evendeaths have occurred during hydro-testing.

There are three basic types of pressure tests thatdiffer by their respective purposes, pressure andduration. A brief description of each type ofpressure test is as follows:

Spike Test - is used to verify the structural

integrity of pipelines with time dependent

anomalies.

Strength Test - is used to establish the

maximum operating pressure limit of a

pipeline segment.

Leak Test - is commonly used to determine

that a process or piping system does notshow evidence of leakage.

Hydrostatic testing should be conducted followingChevron Engineering Standards such as PIM-SC-3541-D, “Hydro-testing of Onshore PipingSystems,” or PPL-EN-700, “Inspection and Testing,”which references ANSI/ASME B31.4 for hydrostatictesting of liquid lines or ANSI/ASME B31.8 fortesting of gas lines. The American PetroleumInstitute (API) Recommended Practice (RP) 1110, “Pressure Testing of Steel Pipelines for theTransportation of Gas, Petroleum Gas, HazardousLiquids, Highly Volatile Liquids or Carbon Dioxide,”

provides guidelines for developing hydro-testprocedures and recommended equipment forconducting the test. These piping codes requirehydrostatic test pressures high enough to stress thepipe up to 90% of specified minimum yield strength(SMYS), depending on maximum design pressureand pipe class. These stress levels are high enoughwhere any anomalies in a pipe segment could resultin sudden catastrophic release of stored energy.This is why it’s critical to follow the correct test

procedure, assemble the equipment correctly and

ensure personnel are out of the line of fire.Pictures (Figures 1 and 2) in this article illustratethe failure of a piping segment during hydrostatictesting at a non-Chevron facility, which led tothree operator injuries. A piping fabricationconsisting of 24" sch. 30 (0.562 wall thickness)pipe and fittings was in the process of beinghydro-tested when the failure occurred. Thefabrication consisted of approximately 80 linearfeet of piping. The hydrostatic test pressurespecified was 2160 psi using water as the testmedia. When the test pressure reached 1740 psi,a 90° elbow suffered a catastrophic failure.

Figure 2

Figure 1


5/15



5

Of the four operators attending the hydro-test, tworeceived severe injuries caused by impact with testequipment being propelled by the water release andone other received a minor injury. This incidentcould have had more severe consequences if thetest media used was a compressible fluid such as air

or nitrogen.

Lessons Learned

This incident illustrates the importance ofunderstanding the hazards inherent withhydrostatic tests and how failure to takepreventive measures can result in seriousincidents. Frequently performed tasks that seemroutine can lead to a false sense of vulnerability.This is why it’s imperative that each task beanalyzed through a robust job safety analysis,including use of the Hazard Identification Tool.

How can you apply learning’s from thisincident to prevent a similar incident in yourlocation?

When planning and conducting hydrostatic testing,ensure that qualified personnel are used to evaluate

hazards, develop procedures, and perform thetesting. Pre-job safety meetings should beconducted to ensure that all personnel are aware ofthe hazards and are familiar with the applicable testprocedures. Procedures should address allnecessary precautions to minimize exposures topersonnel and the environment, including theestablishment of exclusion zones. Procedures shouldalso discuss measures to restrain temporary piping,hoses, and other equipment used during the test;as well as response plans in the event of a testfailure.

Arturo Seyffert and Allen Pendergrass

Designing Procedures for

the Performer

Findings from major incident investigations in the oiland gas industry indicate the most frequent rootcauses cited are related to the use of inadequateprocedures or a failure to follow procedures. TheChevron Major Incident Study (MIS) has alsoidentified the root cause category Procedures andSafe Work Practices as one of the top causesleading to major incidents over the past several

years.

As part of an ongoing research project, ETC SafetySystems has developed Human PerformanceGuidance intended to incorporate humanperformance attributes into the development andreview of operating and maintenance procedures.Part of this includes an accompanying evaluationtool used to review the quality of existingprocedures against the established guidancecriteria.

What is it?

The technical writing guidance and supplemental

tool are provided as optional resources for thoseinvolved in writing, reviewing and updatingprocedures. The guidance provides practical tips onhow to effectively write procedures that are easy tounderstand and follow. The objective of thedocument is to assist in simplifying complicatedsubjects to avoid confusion, therefore minimizingopportunities for human error.

For example, a procedure could instruct an operatorto “perform visual inspection of equipment.” (Figure1) What does that really mean? The procedural

step is worded in an ambiguous way, leaving it upto the operator to interpret what actions need totake place to complete that step in the procedure.The technical writing guidance and supplementaltool steers procedure writers away from situationslike the one described above and providesalternative ways to write clear and conciseprocedural steps. Instead of using vague language,

procedure steps should be written in a clear andconcise manner. Instead of “perform visualinspection of equipment,” the procedure should bespecific as to what needs to be inspected on theequipment (i.e., electrical cord fraying, secure hoseconnections, integrity of seals, etc.)

Figure 1


6/15



6

The guidance assumes a system for managingoperating and maintenance procedures is in place,and supports already established requirements,consistent with the OE Corporate Required Standardfor Operating Procedures.

How does it work?The Human Performance guidance tool can be usedto evaluate existing procedures, as well as to helpwriters develop new procedures. The evaluation tool(Figure 2) consists of a checklist in which theprocedure reviewer identifies whether the procedurecomplies or does not comply with identifiedprocedure writing best practices. Compliance withthese best practices contributes to an overall score.Higher score rankings translate to procedures thathave been written following best practices.

In October, the San Joaquin Valley Business Unitpiloted the procedure evaluation tool on their local

procedures. Evaluation participants includedpersonnel involved in writing, checking, andreviewing procedures. The checklist tool wassuccessful in identifying opportunities in humanperformance writing improvements for eachprocedure and proved valuable as a guide whenreviewing for usability.

Although business units are not required toincorporate the use of this tool, it would bebeneficial for them to identify some higher riskoperations and utilize the tool to evaluate thoseassociated procedures. If reviewing existingprocedures using this tool averts at least oneincident at each location, the time and effort spent

in the review would have been worthwhile.

Where can I get more information?

The Human Performance Guidance – DesigningProcedures for the Performer and tool – ProcedureQuality Review Evaluation Form can be found on the

PSM Resources Site. Information listed on thewebsite provides all the instruction on how to applythe tool.

Support from ETC personnel can be requested tofacilitate a half-day training session dealing with the

application of the human performance style andwriting principles, or to help procedure writersevaluate and modify new and existing procedures.For Human Performance questions or additionalresources, contact Lani Marshall (ETC SafetySystems Manager).

Esau Perez and Michele Seger

Organizational Capability

Process Safety Program -Proof of Concept Underway

Global Workforce Management is partnering withUpstream and Gas; Operations; Corporate Health,Environment & Safety (HES); ETC HES; andFacilities Engineering (FE) on a proof of conceptproject to develop Process Safety Engineers utilizinga 12 to 18 month immersion program. Theobjective of the program will focus on enhancing

critical process safety competencies (e.g., incidentinvestigation & reporting, measurement andmetrics, hazard identification and risk analysis,management of change, emergency management,and auditing) for the individuals in the program.The basis of the competency development will buildon established internal & external training courses,

https://collab001-hou.sp.chevron.net/sites/HESLP/PSM%20Resources/Pages/default.aspxhttps://collab001-hou.sp.chevron.net/sites/HESLP/PSM%20Resources/Pages/default.aspxhttps://collab001-hou.sp.chevron.net/sites/HESLP/PSM%20Resources/Pages/default.aspx


7/15



7

and it will include a robust series of mentoredexperiences. Program participants will be pairedwith a variety of subject matter expert mentors andwill be given opportunities to complete joint projects with their mentors. Eventually, theywill complete independent work under mentor

supervision.

The intent of the program is to provide participantswith experiential learning opportunities directlyrelevant to their home organization; to engage withmentors in process safety activities that will benefittheir business units; and to provide them with aguided, accelerated learning and development

plan. The curriculum is designed to suit the diverseneeds of Operations, Facilities Engineering, and HESpersonnel. Presently, the proof of concept projectteam is completing course development work, andis preparing to receive participants at the ETCBriarpark office in Houston as early as 1Q13.

Participants will be nominated by their homeorganization with an expectation that onlyexperienced Company personnel with process safetyresponsibilities in their current or future positionswill be enrolled.

Ellen Leonard

Process Safety – IncreaseYour Fluency in 2013

The ETC HES Safety Technology Unit produced aProcess Safety wall calendar and distributed manyof them at the 2012 OE Forum in October. Thetheme of the 2013 calendar, “ProcessSafety….Always,” highlights different elements ofProcess Safety.

Twelve case studies were chosen to berepresentative of major industrial incidents. Each

month, one of the case studies illustrates acontributing root cause and its relationship to a keyProcess Safety element. For example, the 1984incident that occurred at a Union Carbide plant inBhopal, India, had a contributing cause, “Failure tomanage change in a manner to support safeoperations.” For that month, the key message is, “Always follow the management of change process,”and some of the fluency points address technicalrigor of functional reviews, understanding thetechnical basis of the change, and updating criticalinformation.

The calendar is intended to increase Process Safetyfluency and to assist those who see it to rememberthe Tenets of Operation are based on two keyprinciples:

1. Do it safely or not at all2. There is always time to do it right.

For more information about how you can receivecalendars, please send a message to CindyRoseberry at [email protected].

Ellen Leonard

mailto:[email protected]:[email protected]:[email protected]:[email protected]


8/15



8

Gas Detector LocationGuidance

The placement of fire and gas detectors has alwaysbeen a challenging task for engineers because the

number of detectors needed, especially for outdoorapplications, depends on the anticipated size of theleak; orientation and direction of the leak; weatherconditions; and several other factors.

Technological developments, innovation, andresponse philosophy continue to make this aninexact science. Unlike smoke and heat detectorplacement, which follow NFPA 72, “National Fire Alarm and Signaling Code”, there are no specificcodes or standards for placement of gas detectors.More recently, the International Society ofAutomation (ISA) issued Technical Report ISA-TR84.00.07-2010, ” Guidance on the Evaluation of Fire,Combustible Gas and Toxic Gas System

Effectiveness,” which provides guidelines forlocating devices using performance based concepts.

A recent study from the UK Health & SafetyExecutive (HSE) shows that between October 1992and March 2002, the overall detection rate of leakswas only 60%.1 The ETC Fire Protection Team isnearing completion of a prescriptive approachguidance document to ensure a consistentmethodology for the placement of fire and gasdevices, and to increase the probability of detectingminor leaks. Flame detectors (a.k.a. “optical” firedetectors) have a definite “cone of vision” and arenot discussed further in this article.

It is important to note that gas detectors areintended to detect a wide range of leak scenarios.The UK HSE defines minor leaks as gaseous or twophase leaks of less than 0.1 kg/s in less than 2minutes.1 The guidance document being developedrequires a thorough review of the following:

Fire and Explosion Analysis

Process Flow Diagrams

Heat and Material Balances

Equipment Lists (with operational and

inventory information)

Equipment Plot Plans

Based on the outcome of the review, the equipmentis categorized (Hazard Category A, B or C) based onthe probability of failures (refer to Figure 1).

Figure 1

Identify Leak

Sources

Categorize

Leak Sources

PFD, H&MBal., P&ID,

Area Class.etc

Locate Leak &

Category Sources

on Layout Drwg

Verify/Review

F&GS Sensor

PlacementDrwg Review

F&GS SensorPlacement in 3D

Model

3D Model Review

Model Review

Comments

Issued For

Construction 2-DExtraction from 3D

Model


9/15



9

Mean Time To Failure (MTTF) rates for someequipment are tracked by and can be obtained fromOREDA (Offshore Reliability Data) and UK HSE.Some equipment, such as gas compression, exportoil, fuel gas & export condensate with 0.1leaks/system year1 are given the highest probability(hazard category) and therefore require higher

percentage coverage. The hazard categories areidentified on the plot plan and the gas detectorslocated accordingly (example given in Figure 2).

Column 2BPREVALENT WIND DIRECTION :

WEST TO EAST

A

Production pumps are Category – A High Hazards

Detector coverage overlap

with Flare Scrubber

A

A

A

APPROX. 15'-0"

Detector coverage overlap

with Manifold Skid

A P P R O X .

1 5 ' - 0 "

Point Gas Detector

Figure 2

The coverage is based on the quantity and/or type(point or open path) of gas detectors providing apercentage of coverage based on the hazardcategory. Category-A requires a high degree ofcoverage (approximately 90%), while Category-Band Category-C require lower levels of coveragerespectively. The detectors are spaced to provide

the maximum coverage based on the anticipatedsize and travel of the vapor cloud formed. In aprevious Fire and Process Safety Newsletter article(“Gas Detector Study” 4), it was explained that theresults of the tests revealed that the flammable gasdetectors were not as sensitive as consequencemodeling had estimated.

While it may not be possible to achieve 100% gasdetection coverage in open, well ventilated processunits or areas, using a more defined approach toincrease the consistency in detector placement willgreatly increase the likelihood of detection.

A new Chevron Engineering Standard (FPM-DC-

1501-B) will provide guidance when sitingflammable and toxic gas detectors. It is anticipatedthis new standard will be released in December,2012.

Bernard Leong

LPG BLEVE Emergency

Response GuidanceDocument DevelopedSeveral process safety events have occurred thatwere catastrophic in terms of both loss of life andcompany reputation. These events would be evenmore tragic if the industry did not learn from othersmisfortune. Through better understanding of theseincidents, we can work to effectively mitigate andmanage this risk in efforts to prevent recurrence atone of our similar facilities.

Effective risk management involves assessing two

categories of safeguards: Preventive safeguards that help to prevent

loss of containment

Mitigative safeguards that limit the risk inthe event of loss of containment

Both types of safeguards are considered inqualitative assessments. However, mitigativesafeguards can be more challenging to assessqualitatively, as it can be difficult to determine thedirect impact on risk reduction. Modeling is often

necessary to determine how far hazard zonesextend and how to best address the risk at aspecific facility.

A Boiling Liquid Expanding Vapor Explosion (BLEVE)in a processing or storage area can result incatastrophic consequences. The BLEVE is typicallyinitiated by a jet fire or pool fire impinging on theshell of an LPG vessel. The shell metal heats updue to the external fire, and exposed areas above

the liquid level can fail catastrophically due to aninsufficient heat sink and overwhelming the vessel’srelief device(s). The flashed LPG vapor rapidlyescapes the vessel, ignites, and vigorously expands.The result is a large fireball that quickly rises. Theattached BLEVE video demonstrates this phenomena.

One of the most catastrophic incidents in the historyof our industry occurred on November 19, 1984, atthe Petróleos Mexicanos (PEMEX) San JuanIxhuatepec Terminal near Mexico City, Mexico.Fatality estimates range from 500 to 600 people,

http://www.youtube.com/watch?v=sl-JgyQA7u0http://www.youtube.com/watch?v=sl-JgyQA7u0http://www.youtube.com/watch?v=sl-JgyQA7u0http://www.youtube.com/watch?v=sl-JgyQA7u0


10/15



10

including workers and the public, while injuryestimates were in the range of 5,000 to 7,000.

The terminal contained a total of six spheres and 48cylindrical horizontal vessels (sometimes calledbullets). This equipment was significantly damagedafter a fire escalated, resulting in a series of

BLEVE’s. The BLEVE’s yielded fireballs up to 1,000feet in diameter. Most of the fatalities occurred in aneighboring town, thousands of feet from thestorage area, due to the intense radiant heat of thefireball. Projectile fragments from the spheres andvessels were found up to 2,500 feet away from thestorage area. Some fragments hit homes or otherstorage equipment, sometimes adding fuel to thefire. Local emergency responders spent hoursfighting the flames, trying to avoid furtherescalation.

The incident investigation began after the flameswere extinguished. There are uncertaintiesregarding the triggering event. Possible crediblecauses listed in the incident investigation reportinclude a pipe leak / rupture, a relief valve failure ofan overfilled vessel, or unburned gases from theflare.

Since the PEMEX event, industry has madeimprovements in preventive safeguards includingimproved facility design specifications regardingspacing, process controls, and relief valves to helpprevent loss of containment events leading to aBLEVE.

As mentioned previously, mitigative safeguards canbe more challenging to evaluate and enhance. Theincident investigation report provided severallearnings that were used to develop a ChevronLPG BLEVE Emergency Response Guidance Document with the aim of enhancing thesesafeguards at facilities where LPG is stored. Some

key learnings from the PEMEX incident investigationreport have been incorporated into the GuidanceDocument, as listed below:

A BLEVE often results in a largefireball, which emits intense thermalradiation. An emergency responseplan should be developed in advancethat addresses evacuation or takingshelter from the radiant heat. (Seedistances provided in the GuidanceDocument.)

Fragments from horizontal vesselsshow a strong directionality in the axial

direction. Emergency evacuation routesshould be planned such that personnelescape in the radial direction, relativeto the LPG vessels.

If an explosion is heard, it is best to lieflat on the ground, face down. Thisposture limits exposure to the intenseheat from the fireball, whichimmediately follows the explosion in aBLEVE.

When the risk of BLEVE is deemed high(e.g., after vessel relief valve opens orfor intense fires on larger spheres),

firefighting efforts should be limited toa defensive mode with personnel at asafe distance. Typical bunker gear(protective clothing for firefighters) isNOT generally rated for the extremefire exposure that may be generatedby a large BLEVE.

Before

During

After

http://etc.chevron.com/hes-riskman/documents/LPG_BLEVE_Emergency_Response_Guidance_Rev_0_20121214.pdfhttp://etc.chevron.com/hes-riskman/documents/LPG_BLEVE_Emergency_Response_Guidance_Rev_0_20121214.pdfhttp://etc.chevron.com/hes-riskman/documents/LPG_BLEVE_Emergency_Response_Guidance_Rev_0_20121214.pdfhttp://etc.chevron.com/hes-riskman/documents/LPG_BLEVE_Emergency_Response_Guidance_Rev_0_20121214.pdfhttp://etc.chevron.com/hes-riskman/documents/LPG_BLEVE_Emergency_Response_Guidance_Rev_0_20121214.pdfhttp://etc.chevron.com/hes-riskman/documents/LPG_BLEVE_Emergency_Response_Guidance_Rev_0_20121214.pdfhttp://etc.chevron.com/hes-riskman/documents/LPG_BLEVE_Emergency_Response_Guidance_Rev_0_20121214.pdfhttp://etc.chevron.com/hes-riskman/documents/LPG_BLEVE_Emergency_Response_Guidance_Rev_0_20121214.pdf


11/15



11

The Canary BLEVE prediction model (software fromQuest Consultants, Inc.) was used to calculateBLEVE Hazard Zone estimates for personnel.Emergency response guidance is provided basedupon the consequence predictions. The ChevronLPG BLEVE Emergency Response GuidanceDocument can help site operations and/or

emergency responders think through a potentialBLEVE incident before it happens. This can identify

improvement opportunities in our mitigativesafeguards, which, if implemented, can reduce thelikelihood of potentially high consequences thatmight result from a BLEVE.

Chris Robinson and Wilbert Lee

Risk Reduction UnlessUnreasonable – Means ofDemonstration

Background

A key concept underpinning Chevron’s HES RiskManagement Process is the demonstration that riskshave been reduced until further risk reduction isunreasonable. In certain areas where Chevronoperates (notably the United Kingdom andAustralia) this requirement is further enshrined inlaw, where risks have to be reduced to a level thatis “As Low As Reasonably Practicable” (ALARP).

In practice, what this means is that a facility has toshow, through reasoned and supported arguments,that there are no other practical measures thatcould reasonably be taken to further reduce risks,rather than simply following prescriptive

requirements for risk mitigation measures. Whilethis flexibility is a great advantage, it can prove tobe challenging because it requires people toexercise judgement with respect to how they aregoing to manage their risks.

Some History

The legal definition of reasonably practicable wasset out in England by Lord Justice Asquith inEdwards V National Coal Board [1949] who said:

‘Reasonably practicable’ is a narrower termthan ‘physically possible’ and seems to me toimply that a computation must be made by theowner, in which the quantum of risk is placed

on one scale and the sacrifice involved in themeasures necessary for averting the risk(whether in money, time or trouble) is placedin the other; and that if it be shown that thereis a gross disproportion between them — therisk being insignificant in relation to thesacrifice — the defendants discharge the onuson them. Moreover, this computation falls tobe made by the owner at a point of timeanterior to the accident .

This English decision has since been confirmed by

the Australian High Court. There does not appear tobe a legal equivalent in the United States.

Some Key Principles

When developing risk reduction measures anddetermining whether risk is ALARP, some essentialprinciples should be considered. Asking cost-benefitquestions such as, “Have the risks been lowered inbalance with the time, trouble and costs associatedto adequately reduce the risks?” may help provide aconceptual framework to launch into furtherevaluation. (Figure 1)

Reasonableness – Determining whether risks havebeen reduced as low as is reasonable involves anassessment of the risk to be avoided, anassessment of the sacrifice (in money, time andeffort) involved in taking measures to avoid thatrisk, and a comparison of the two. The greater the

Figure 1


12/15



12

initial level of risk under consideration, the greaterthe effort likely to be required to demonstrate thatrisks have been reduced to a level that is as low asreasonable; however, just because the initial levelof risk may be low doesn’t mean that furtherconsideration should not be given to reasonablyreduce the risk. The basis on which the comparison

is made involves the test of ‘gross disproportion’.

Gross disproportion – If a measure is reasonableand it cannot be shown that the cost of the measureis grossly disproportionate to the benefit gained,then the measure is considered reasonable andshould be implemented. The criterion is reasonablebut not reasonably affordable: justifiable cost andeffort is not determined by the budget constraints/viabilityof a project.

Good practice – Decision-making should factor therelevance of ‘good practice’. In general, goodpractice refers to any well defined and establishedstandard practice adopted by an

industrial/occupational sector, including ‘learnings’from incidents that may yet to be incorporated intostandards. Good practice may change over time dueto technical innovation, or because of increasedknowledge and understanding.

D em o n s t r a t i o n t h a t R i sk i s R e a so n a b l e

Throughout the life cycle of an asset, it is importantto make consistent risk judgments. At variousstages, evaluations may be needed to assess risksand select controls that will reduce the risk as lowas reasonably practicable. The followingapproaches may be considered to justify thatfurther measures to reduce risk are unreasonable –in practice a combination of two or moreapproaches may be required.

ComparativeAssessment ofRisks, Costsand Benefits

Evaluate risk and associatedcosts for a range of controlmeasures and compare therelative merits of each.

Comparisonwith Codesand Standards–etc.

Compare design, themanagement system frameworkand operational proceduresagainst recognised national,international or industrystandards, codes of practice,

guides

Audit againstgood practice

Audit the basis andimplementation of themanagement system, includingoperations and maintenancesystems, against good practicefor similar facilities.

TechnicalAnalysis

Evaluate control measures intechnical terms; assess strengthsand weaknesses, e.g.,effectiveness, functionality,availability, reliability, technicalfeasibility, compatibility,survivability, correspondence of

control measures to hazards andrisks, appropriateness ofperformance standards, etc.

PerformanceData

Evaluate safety-related performancedata/metrics as evidence ofadequacy or satisfactory levels ofperformance, e.g., data on theoperational effectiveness orreliability of a control measure maysupport the demonstration of itsappropriateness for that service.

ImprovementApproach

Demonstrate the extent of relativeimprovements in performance for

the facility based on past, presentand planned modifications andenhancements.

JudgementApproach

Present considered judgements asto the suitability of controlmeasures and the managementsystems.

Practical Tests Demonstrate that the managementsystem and/or control measuresfunction effectively, using majoraccident event simulations,management system tests,equipment breakdown and recovery

tests, etc.

P i t f a l l t o B ew a r e : R e v e r s e A LARP

It is possible to argue that the increase in riskrealized by moving to a less protected situation isbalanced by gains in reduced operational costs orincreased operating profit – this is considered areverse ALARP argument. The requirement toreduce risks as low as reasonably practicable wouldrule out accepting a less protected but significantlycheaper approach to the control of risks.

For additional guidance on ALARP, contact the ETCProcess Risk and/or Process Safety Teams.

Rod Travis


13/15



13

What’s wrong with this picture?

A process vessel is located on an upper level in a plant structure and thedischarge piping includes a glass portion. The floor is solid steel plate withtoe boards that act as a small containing berm. The process fluid is xylene.

Answer on page 15


14/15



14

ETC Safety Technology Unit

Team Members

Fire Protection Team Process Safety Management Team

Steve Bruce, Team Lead CTN 842-4082 Charles Foshee, Team Lead CTN 954-6925

Tim Blackford CTN 954-6987 John Edmed CTN 545-5177

Glenn Kent CTN 842-3926 Mike Kelly CTN 954-6080

Bernard Leong CTN 954-6345 Steve Kovach CTN 954-6195

James Mansingh CTN 954-6238 Jesse Meyer CTN 842-5538

Justin Schmeer CTN 954-6340 Allen Pendergrass CTN 954-6018

Arturo Seyffert CTN 842-6272

Process Risk Management Team Safety Systems Team

Steve Bruce, Team Lead CTN 842-4082 Lani Marshall, Team Lead CTN 842-4224

Gonzalo Garcia CTN 546-6960 Carlos Adams CTN 954-6321

Francois Joseph CTN 954-6976 Angela Barrow CTN 372-5562

Wilbert Lee CTN 842-4111 Sarah Dabney CTN 954-6947

Mark Meyer CTN 954-6102 Kelly Doughty CTN 842-0605

Chris Robinson CTN 842-4865 Lindsay Hamilton CTN 842-3947

Jim Salter CTN 842-4105 Sahika Korkmaz CTN 842-9463

Rod Travis CTN 216-5151 Sharon Light CTN 372-1987

Lisa Veltman CTN 954-6186 Sue McDonald CTN 954-6193

Esau Perez CTN 954-6346

Laurie Rittenour CTN 842-8266

Michele Seger CTN 954-6038

Todd Wilhite CTN 842-0426

Jason York CTN 954-6882

Major Capital Projects Team Safety Technology Unit Manager

Kevin Watson, Team Lead CTN 954-6185 Mike McDonald CTN 954-6108

Robert Dayton CTN 954-6375

Theo Dekoker CTN 954-6031 Administrat ive Ass is tant

Marine Julliand CTN 372-6727 Cindy Roseberry CTN 954-6043

Michelle Lizio CTN 954-6292

Ty Walraven CTN 954-6091

Direct your email questions to “AskETCHES” or to [email protected]. Your message isimportant to us, and our goal is to put you in touch with the best resource within two business days.


15/15



15

Answer to What’s Wrong With This Picture?

The glass piping pictured presents risk that may be unacceptable at two levels.

1. The glass is not adequately protected from potential breakage due to a passerby

impacting the glass with tools or other objects being carried through the area (e.g.

a ladder or section of pipe).

2. The long bolt application would not likely provide a stable flanged setup when

exposed to the heat of a fire. This risk is elevated by the use of only four bolts in

this setup. The glass could potentially break due to stresses resulting from

movement of the flanged setup.

If a process application requires use of glass components, the following should beconsidered:

• The materials of construction should be suitable to the process application and

should be selected based on an assessment that they are:

o Chemically inert to the process fluids;

o Surface resistive to erosive properties of the process fluids;

o Designed to withstand the process pressures and temperatures;

o Resistive to the potential temperatures that could be realized if pool fire or

flame impingement exists; and

o Properly guarded against inadvertent impact.

• The Chevron Fire Protection Manual section 2092 restricts the use of long boltflanging systems. A suitable fire resistant holder should be used to place the glass

in the process flow line.

Tim Blackford and Steve Kovach

fire process safety newsletter 4th quarter 2012

Documents