PSF - Process Safety Fundamentals

IOGP Data (2007-2017):

128 fatalities in 56 process safety events.

IOGP Process Safety Fundamentals (PSFs)

developed to reduce/eliminate severe process safety events.

PSFs

• support front-line operations, maintenance, and wells teams.

• Informed by data to highlight situations likely to lead to fatalities.

• Not exhaustive; supplements company's process safety management systems.

Process safety

• A disciplined framework for managing the integrity of systems handling hazardous substances

• Goal: Prevent unplanned releases to avoid major incidents.

PSFs

• aim to clarify process safety in daily activities for the front line

• do not replace existing systems (management systems, policies, training, procedures, instructions).

• They rely on these frameworks

PSFs supplement IOGP Life Saving Rules (LSRs)

they are separate, not combined.

LSRs

Primarily personal safety, some process safety overlap.

PSFs

Specifically targeted at process safety hazards.

TRUE

Overlap exists (e.g., Energy Isolation), but PSFs treat process safety hazards specifically.

Key success factor

• : Presentation and tone of PSFs.

• Unlike mandatory, strictly enforced Life-Saving Rules programs.

PSFs support the front-line for successful process safety performance.

• Employees should voice difficulties in aligning with PSFs without fear of criticism.

• Issues should be openly reported for company resolution.

• Flexibility is crucial; PSFs are a supportive tool, not just 'another set of rules'.

• PSFs should not be associated with disciplinary measures for non-conformance.

• Punitive approach may negate potential benefits.

Life-Saving Rules

Focus: Strong focus on personal safety with some process safety overlap

Flexibility: Single common industry set recommended by IOGP

Process Safety Fundamentals

Focus: Solely focused on process safety

Flexibility: Core set recommended by IOGP, with flexibility to supplement based on local challenges

IOGP believes PSFs apply to downstream operations as well.

Downstream companies may add supplementary PSFs for specific local issues.

Fatal wells-related process safety events are part of IOGP PSFs development analysis.

Companies applying to well operations may add supplementary PSFs for well activities.

IOGP seeks industry standardization with a core set of 10 PSFs.

• However, companies may exchange a small number for tailored alternatives.

• Align with the core set as far as possible and exercise caution in removing core PSFs. Core set selected based on thorough data analysis.

Continuous improvement cycle:

• IOGP will regularly seek feedback on the effectiveness of the 10 core PSFs.

• Feedback includes other useful PSFs, adaptations, or supplementary PSFs for downstream and wells activities.

• IOGP may update recommended PSFs based on real-world application feedback.

Intended outcomes of adopting PSFs:

• Focus on process safety at the front-line.

• Enables process safety concerns to be raised and addressed.

• Promotes industry-wide common language for process safety.

• Helps companies eliminate high severity process safety events

We Respect Hazards

• Improve understanding of process safety hazards and roles in controlling them.

• Be vigilant about the potential impacts of uncontrolled process safety hazards.

• Discuss process safety hazards before starting a task.

• Bring forward process safety hazards to be included in activity risk assessments

We Apply Procedures

Use operating and maintenance procedures, even if familiar with the task.

Discuss the key steps within a critical procedure before starting it.

Pause before key steps and check readiness to progress.

Stop, inform supervision, and avoid workarounds if procedures are missing, unclear, unsafe, or cannot be followed.

Take time to become familiar with, and practice, emergency procedures.

We Sustain Barriers

• Discuss the purpose of hardware and human barriers.

• Evaluate how tasks could impact process safety barriers.

• Speak up when barriers don't feel adequate.

• Perform roles in maintaining barrier health and alert supervision to concerns.

• Use an approval process for operations with degraded barriers.

We Stay Within Operating Limits

• Discuss and use the approved operating limits.

• Escalate where it is not possible to work within the operating limits.

• Alert supervision if alarm response action is unclear or the time to respond is inadequate.

• Obtain formal approval before changing operating limits.

• Confirm that potential for overpressure from temporary pressure sources has been addressed.

We Maintain Safe Isolation

Use isolation plans for the specific task with up-to-date information.

Raise isolation concerns before the task starts and challenge when isolation plans cannot be executed.

Check for residual pressure or process material before breaking containment.

Monitor the integrity of isolations regularly and stop to reassess when change could affect isolation integrity.

Confirm leak-tightness before, during, and after reinstating equipment.

We Walk the Line

• Use up-to-date documentation (e.g., P&IDs) that accurately reflects installed systems and equipment.

• Physically confirm the system is ready for the intended activity (e.g., valve positions, line up of relief devices, etc.).

• Alert supervision to identified documentation and readiness issues before operation.

We Control Ignition Sources

• Identify, eliminate, or control the full range of potential ignition sources during task risk assessments during job preparation and execution.

• Minimize and challenge ignition sources, even in "non-hazardous" areas.

• Eliminate ignition sources during breaking containment and start-up and shutdown operations.

We Recognize Change

• Look for and speak up about change.

• Discuss changes and involve others to identify the need for management of change (MOC).

• Review the MOC process for guidance on what triggers an MOC.

• Discuss and seek advice on change that occurs gradually over time.

We Stop if the Unexpected Occurs

• Discuss the work plan and what signals would tell us it is proceeding as expected.

• Pause and ask questions when signals and conditions are not as expected.

• Stop and alert supervision if the activity is not proceeding as expected

We Watch for Weak Signals

• Proactively look for indicators or signals that suggest future problems.

• Speak up about potential issues even if we are not sure they are important.

• Persistently explore the causes of changing indicators or unusual situations.

WE RESPECT HAZARDS

• Incident investigations: Lack of hazard awareness is an underlying cause of many process safety events.

• Understand process safety hazards and potential harm if control is lost.

• Typical hazards: Flammable liquids/vapours, combustibles, toxic chemicals, asphyxiants, corrosives, pyrophorics, high pressure/temperature.

• Risk Normalization: Desensitization to hazards due to routine work close to them.

Leads to insufficient respect and thoroughness in controlling hazards.

Underestimation of potential impact, especially without direct involvement in major accidents.

• Pictures/videos of previous incidents can reinforce potential consequences.

• Teams should discuss hazards and understanding of potential impacts, involving company's process safety specialists to explain the facility's process safety studies.

• Personal vs. Process Safety:

Personal safety issues are often more obvious, leading to missed process safety hazards.

Both are vitally important and need due attention.

Be alert for risk assessments that do not cover all associated process safety risks.

• Guidance on major hazard analysis:

Safety Cases, PHAs (Process Hazard Analysis), Safety Reports, Corporate Risk summaries, and other internal resources.

• Tips for Managers:

Routinely discuss accident hazards with front-line workers.

Check that risk assessments address both personal and process safety hazards.

Encourage workers not to become desensitized to process safety hazards.

• Additional guidance:

Energy Institute Reflective Learning Video - Removing the hazards

Step Change in Safety - Major Accident Hazard Understanding videos and tool packs Videos and other COPS Beacon August 2019

US Chemical Safety Board Preliminary Animation of Pittcoatonia Energy Solutions Refinery Fire and Explosions

US Chemical Safety Board: Safety Message

WE APPLY PROCEDURES

• Many operations are complex and/or have potential to release hazardous materials if not performed correctly.

• Step-by-step procedures are developed to perform tasks safely and prevent hazards.

• Use procedures on site and job aids (e.g., sign off) to confirm key steps in correct sequence.

• Companies should identify "critical" activities requiring "sign off" for each step.

Typically, startup/shutdown of a facility, or particularly hazardous activities like pigging, are considered "critical" procedures.

• Before starting a procedure, discuss the task ahead and how it is expected to proceed.

Discuss key steps, particularly irreversible ones, and what will be expected at those stages to confirm readiness to proceed further.

• If you identify issues with the quality or completeness of the procedures such as a lack of clarity on a task or missing/incorrect data, then this should be raised so they can be addressed as part of your MOC process.

• It is easy to become complacent about an activity that has been performed many times before without hazardous or unwanted outcomes. However, no matter how experienced we are, it is easy to make a mistake, and therefore it is important to apply the procedures thoroughly, every time.

• If you cannot complete or follow the procedure as it is currently written or you think there is an issue with the procedure, halt the activity and raise the issue with your supervisor. If you think there is a better way of performing an activity/task discuss it with your supervisor and raise a formal change request.

• Sometimes an activity or operation is not completed in one shift, and it therefore is important to ensure there is an effective shift handover process so that the new shift has accurate knowledge of the status of operations and any issues they should be aware of.

• If a hazardous situation occurs, it is also important to understand and apply emergency response procedures. These need to be readily usable in more stressful situations and regular practice drills help to reinforce understanding and familiarity.

• Tips for Managers:

Ensure that procedures are up-to-date effective, and easy to use

Follow up if concerns about a procedure are raised,

Ensure that personnel have time to become familiar with the plant, its equipment, and its procedures!

Review procedures with front lines staff during site visits

• Additional guidance:

Refer to local company guidance on procedures and consider linking to Human actors guidance

Center for Cheroical Process - ICCPSIL Guidetraps fo Writing Effective Operating and Maintenance Procedures New York 1996

US Chemical Safety Board Fire in Baton Rouge

WE SUSTAIN BARRIERS

• Companies should think about the mental model of barriers that control process safety hazards.

• Barrier: risk control that prevents unintended events or stops escalation to harmful consequences.

• Barriers can be hardware or human.

Hardware: physical equipment and engineered systems designed to prevent hazardous releases or mitigate their consequences. Maintained and tested by people, but do not rely on human action when a demand is placed on the barrier.

Human: rely on actions of people when a demand is placed on the barrier, for example response to a process alarm.

Hardware barriers have greater reliability if maintained correctly.

• Front-line teams should discuss facility barriers, their reliability, and effectiveness.

• Individuals should feel able to speak-up if they believe a barrier is weak or adequate, or by practicing independent verification by coworkers.

• A bowtie diagram or a simplified scenario diagram showing the equipment and important barriers contained within the scenario can be a helpful visual aid when having this conversation.

• Understanding the role that barriers play, and what could potentially happen if a barrier fails, is important as it allows teams and individuals to understand the influence they have in sustaining barrier health.

• Process safety events can result from degraded or failed barriers.

Degraded barriers: inhibited, overridden, bypassed, unreliable or unavailable.

Should be addressed without delay and normally require approval for continued operations.

Front-line workers play a key role in sustaining and monitoring mitigations while a degraded barrier is being restored.

• Tips for Managers

Provide tools for staff to understand and use safety barriers at their location.

Discuss process safety barriers with front line workers during site visits.

Ensure that systematic barrier management ensures necessary resources are allocated to test and maintain barriers

Implement approved risk reduction measures for degraded or failed barriers and restore barrier functionality as soon as Additional guidances.

• Additional guidances

Energy Institute: Reflective Learning Lown my barrier effective learning, keep my barrier strong.

US Chemical Safety Board Station of April 26, 2018: Explosion and Fire at the Superior Wisconsin

US Chemical Safety Board: Blowout in Oklahoma

Safer Together Process We all have a part to play

WE STAY WITHIN OPERATING LIMITS

• Operating equipment outside of safe operating limits (temperature, pressure, level, flowrates) can result in unstable and unpredictable operation and the potential for process safety incidents.

• It is useful for teams to discuss how these limits are documented at their site and whether the limits are clear and available

• Overfilling and overpressure are the most common operating limit excursions that lead to process safety incidents.

• One common type of fatal process safety related incident occurs when a temporary source of high pressure (e.g., pump, compressor, nitrogen bottle, etc.) is connected to the process with inadequate overpressure protection.

This can lead to catastrophic failure impacting those working in the area even if the release does not ignite. Teams are encouraged to think about occasions when temporary pressure sources are used at their facilities and confirm that strong process safety barriers are present. Bear in mind that these are usually abnormal activities when regular barriers may not be in place.

• Confirming sufficient capacity for material transfers and monitoring the transfer whilst it progresses are important aspects of staying within the operating limits for level. Teams can discuss the potential for overfilling at their facility. and whether the requirement for monitoring transfers are realistic given other workload and distractions.

• Some potential operating limit excursions are less obvious for example:

Change in fluid composition - with the potential for corrosion and/or erosion. This could be sudden (e.g., sand breakthrough from a well) or gradual (e.g., increasing water or hydrogen sulphide content of well fluids).

Velocity changes due to lower operating pressure - leading to excessive vibration or erosion.

• Teams can discuss other potential operating limit excursions relevant to their facility. Where there are concerns, advice should be sought from supervision and support groups. While there is always a desire to return to normal operation as soon as possible it is imperative to investigate and understand the causes of an excursion to enable prevention of reoccurrences.

• Tips for Managers:

Establish and document safe operating limits for key process variables and them visible to front line Workers.

Regularly check that personnel have the necessary skills and knowledge, to stay within operating limits.

Systematically investigate excursions outside operating

Demonstrate trotting decisions that cost production or schedule does ottoverride safety Additional guidance

• Additional guidance:

IOGP Report 456 Process safety recommended practice on key performance indicator

Center for Cherficat Process Safety Beacon November 2007

Cold Embrittlement and Thermal Stress

US Chemical Safety Boards Anatom of a disaster

WE MAINTAIN SAFE ISOLATION

• It is important for every activity that requires breaking containment, that an appropriate isolation plan for the specific activity is used and followed. Some process safety incidents have occurred when an isolation plan for a similar (but not identical) task has been used but did not address all the relevant hazards. Isolation plans should therefore match the particular task and be based on up-to-date process safety information (e.g., P&IDs).

• It is good practice to discuss isolation tasks and to raise concerns before the task begins. This enables concerns to be raised and resolved safely.

• If for some reason the isolations cannot be executed as planned, you should stop work and seek advice from your supervisor on how to proceed safely.

• Concerns raised might include isolations that do not achieve positive isolation, quantities of drained materials that are more or less than expected, or indications of the presence of significant residual pressure or material.

• After breaking containment, it is important to remain vigilant to potential signs that might indicate that the effectiveness of the isolations, venting or draining arrangements have changed. This could include difficulties with proceeding with a task (e.g., due to trapped pressure or vacuum), more liquids arising, new smells, etc.

Always make sure that you are either in sight of, or in control of the isolations you are using for your job. Before putting equipment back into service, it is important to verify that the system is mechanically complete using your local practices.

• Be vigilant about potential false pressure indications (e.g., line plugs, hydrates, etc.).

• Before introducing hydrocarbons, it is good practice to perform a gross leak test where possible.

• Tips for Managers:

Monitor isolation practice at You location to verify that your local practice is safe and effective. Implement improvement where issues are identified.

Respond and follow up Isolation concerns are raised

Regularly check that those performing isolations are Teffectively trained and ported More information on good practice related to his PSF can be found either. vi. your local management system/procedures or in the following industry guidance

• Additional guidanceMTX Health and Safety Executive: the sale isolation of plant and equipment

WE WALK THE LINE

• Need to check process systems are ready for the next stage of intended operation, to avoid releases.

• Fatal incidents have occurred when the process system was used, but its condition was not as intended.

• Important to check systems are in good condition and correctly set-up each time we start them up or make a significant change in their use.

• This involves a physical, systematic inspection of the system in the field, sometimes in tandem with monitoring from the control room.

• Process safety information (e.g., P&IDs) used to confirm readiness must be accurate and up to date.

• Physically checking systems is not always easy due to difficulties in access or visibility.

• Teams are encouraged to discuss the challenges of performing thorough walk the line checks and alert supervision to readiness or documentation concerns.

• Examples of when to walk the line include:

Material Transfers

Equipment changes

Handover from another work group

Manual change in operational state - equipment idled on another shift

Start-up after prolonged outage

Changing direction of flow

Return to operation after maintenance or turnaround.

Changeover of equipment (e.g. relief valves, filters, pumps, compressors)

Batch operations (e.g., pigging, bed regeneration]

Temporary pipework in wells operations

• What should we do: We physically verify the system is ready for intended operation, for example:

P&IDs and other relevant information are consulted.

Equipment and safeguards are installed correctly and functioning.

Plugs, drain valves, blinds and spades are installed.

Locked open/closed valves are in correct position. Relief routes are not blocked.

Unintended routes to atmosphere are isolated.

Pressure is verified.

If necessary, clear communication between the control room and the field is maintained (e.g. confirming equipment tags before performing an operation).

• Tips for Manage

Regularly confirm that safety information: accurate and up to date.

Walk the line issues with from fine worke's and follow up on concerns raised

• Additional guidance Center for Chemical Process Safety Beacon August 20151 - Operational Readiness

WE CONTROL IGNITION SOURCES

• If a hydrocarbon release does occur, one can often reduce or eliminate the worst of the potential consequences by avoiding ignition.

• About half of the fatal process safety incidents reviewed involved ignition.

• Minimizing the likelihood of ignition can make a big difference in avoiding fatalities.

• Some sources of ignition may be quite obvious, like hot work or nearby fired heaters, but others are less clear.

• Fatal incidents in the IOGP data show that ignition sources include hot work, static electricity, pyrophoric materials, ingestion into generators or other fired equipment, hot surfaces, lightning, defective electrical equipment and vehicles.

• Staff are therefore encouraged to understand the full range of potential ignition sources that are relevant to their facility and the measures in place to control them.

• Use of hazardous area classification/zoning is widespread in the industry.

• Flammable cloud from larger releases can extend far beyond the classified/zoned areas.

• Risk assessments and risk control measures will need to take this into account.

• In preparing for and conducting work activities, consider and act on the following:

Ignition sources can include vehicles, open flames, grinding tools, pyrophoric materials, electrical equipment, hot surfaces, lightning, static electricity, and other portable electrical equipment.

Reporting of defects in electrical equipment and other potential ignition sources, such as cladding on hot surfaces, damaged EX equipment, open wires, damaged grounding aids, is important in controlling potential ignition.

Vehicle entry into areas with the potential for flammable release should be avoided where practical. If that is not practical, vehicle entries should be minimized and controlled.

Control of work risk assessments should evaluate the potential for flammable hazards even outside classified/zoned areas shown on the area classification drawing.

• Tips for Managers:

Regularly check that personnel understand the full range of potential ignition sources and the For ignition source control.

• Additional guidance

JEC 60 079 series

ANSVARI RR 50S

El Model Code of Safe Practice 15 - Cation for installations handling ble funds

Center for Chemical Process Safety Beacon August 2016 Auttle static can cause a lag fire!

Center for Chemical Process Safety Beacon August 2014 - ignition Sources

WE RECOGNISE CHANGE

• Management of change (MOC) failure has been recognised for a long time in the oil and gas industry as being a cause of process safety incidents.

• It is normal for companies to have a management of change process in place, but despite this, the IOGP fatality data indicates that MOC continues to be linked to many fatal accidents.

• Most typically this is when a change was made without passing it through the MOC process, meaning that it did not get thoroughly reviewed and risk assessed.

• This can be because it was not realised that the change needed a MOC, so it is important that teams understand and are sensitive to what changes need to pass through the MOC process. This enables them to look out for change and speak up if they see a change occurring that they think should be managed by the MOC process.

• Whilst it is expected that companies will have an MOC process in place already, this PSF focusses on recognising change that needs to be subject to MOC. Sometimes changes that might appear quite small can have a large impact on process safety, either by introducing new hazards or degrading existing barriers. It is good for teams to discuss changes at their location and to involve others to help identify whether management of change is needed.

• Change, which can be permanent, temporary or emergency, is not limited to hardware modifications and can typically include:

Operating or maintenance procedure revisions

Changes to operating limits

Changes to process operating conditions (e.g., temperature, pressure, flowrate, composition)

Equipment changes (non like-for-like replacement)

Change of chemicals or materials

• Teams can review their local MOC process for guidance on what triggers their MOC process and discuss examples at their location.

• It is recognised that there may be pressure to "get work done" but experience has shown that change must be systematically managed in all situations to avoid unwanted incidents.

• It is also important to remain alert to change that occurs slowly, perhaps over many years. This "creeping change" (e.g., gradual change in process fluid composition or gradual reduction in a team's experience level) also requires evaluation. Taking time out to discuss creeping change or perhaps the impact of multiple small changes on the same system, can be useful in avoiding incidents and teams can seek advice or alert supervision if they have concerns.

• Tips for Managers:

Verify that systematic identification and management of change processes are in place + working effectively.

Ensure that workforce personnel and management are trained to recognize change.

• Additional guidance

Energy Institute, GCPS OSHA Process Safety Management Systems

Center for Chemical Process Beacon MEW 2017/1: Management of Change

Center for Chemical Process Safety Beacon (September: Can you recognize chande?

Center for Chemical Process Safety Beacon (October 2012) Manage Temporary Changes

WE STOP IF THE UNEXPECTED OCCURS

• Activities are normally planned carefully, thinking about how they are expected to proceed and what could potentially go wrong.

• Often process safety incidents have occurred when an activity has deviated from the expected path, but those involved have continued anyway or informally adapted the plan on-the-run. While this may be well-intended, to get the job done, it has the potential to lead down a path that has not been fully evaluated and risk assessed.

• This process safety fundamental highlights the importance of recognizing when things are not progressing as expected and being disciplined about stopping or pausing to understand what has changed and why things are not as planned. Often this may need a change to the plan or an update of the risk assessment, or it may prompt consultation with others to seek specialist input. We should be ready to speak up and challenge in unexpected situations and engage with supervision to discuss our concerns. Pausing or stopping a task may feel inconvenient at the time but keeping an activity on plan and under control will avoid incidents, keep people safe, and support good business performance.

• Tips for Managers

Positively recognize people who step to reevaluate a task if it is not going as planned

Communicate to front-line workers that they should delice and seek guidance if Additional guidance

• Additional guidance Center for Chernitat Process Safety Beacon Security 2014) Persistence - Good or Bad?

WE WATCH FOR WEAK SIGNALS

• One characteristic of most major process safety incidents is that before they occurred, there were noticeable indications that a problem was developing.

• Examples of weak signals include unusual vibration, ice unexpectedly forming on the outside of a pipe, weeps and seeps, passing valves, reoccurring alarms, or abnormal field readings.

• Good practice for teams to discuss examples of weak signals that they have seen in their facility.

• The key is to identify these "weak signals" and respond to them before something more serious occurs.

• Front-line workers are often those best placed to pick up on weak signals as they become very familiar with what is normal and what is not.

• Personnel are therefore encouraged to remain alert to these signals, even if they seem unimportant, so that they can be discussed and evaluated.

• Operator rounds, visual inspections or just going about our routine work at site, are times when we can use our eyes and ears to remain alert to anything that seems out of place or different.

• When weak signals are identified and reported it can be tempting to dismiss them too readily. Weak signals can be a vital opportunity to act early to avoid an accident, so it is important that they are persistently explored to understand the cause.

• It is important to remain constantly aware of the potential for process safety incidents. Some companies describe this as maintaining a state of "chronic unease". Always being aware of our vulnerability to a process safety event helps us to avoid having one!

• Tips for Managers

Be alert to weak signals and respond pro-actively when these signals are raised.

• Additional guidance

Energy Institute Ref Learning Tools: OMIC unease

International Association of Oil and Gas Producers Week signals video